Critical Denial of Service Vulnerability in HAProxy Package
Summary
ALSA-2025:21693: Important: haproxy security update. Affects haproxy versions < 2.8.14-1.el9_7.1. Fixed in 2.8.14-1.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAProxy is a widely used open-source software that provides a reliable, high-performance network load balancer for TCP and HTTP-based applications. It is known for its ability to handle a large number of concurrent connections and offers features such as SSL termination, health checks, and advanced routing capabilities. However, like any software, it can be susceptible to vulnerabilities that may impact its performance and security.
Vulnerability Detail
The vulnerability identified as CVE-2025-11230 is a denial of service issue found in the mjson library of HAProxy. This vulnerability can be exploited by an attacker to disrupt the normal functioning of the HAProxy service, potentially leading to service outages. The technical details indicate that the flaw arises from improper handling of certain inputs, which can overwhelm the service and cause it to become unresponsive.
How To Fix
Minimum fixed version
2.8.14-1.el9_7.1
This is the first release that contains the fix.
sudo dnf update haproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the number of connections to the HAProxy service or implement rate limiting to mitigate the impact of potential denial of service attacks until the package is updated.
Conclusion
The HAProxy package has a critical denial of service vulnerability (CVE-2025-11230) that can significantly impact service availability. It is crucial for users to update to the patched version to ensure the security and reliability of their applications.
See every vulnerability recorded for haproxy →
FAQ
CVE-2025-11230 is a denial of service vulnerability in the HAProxy mjson library that can cause the service to become unresponsive.
You can check your HAProxy version by running 'haproxy -v' in your terminal. If it is below 2.8.14-1.el9_7.1, it is affected.
Exploitation of this vulnerability can lead to service outages, affecting the availability of applications relying on HAProxy for load balancing.
Yes, tools like Vulert can monitor and alert for open-source vulnerabilities in your software by analyzing manifest files like package-lock.json.
For more details, refer to the CVE page associated with CVE-2025-11230, which provides in-depth information about the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
