Critical Denial of Service Vulnerability in HAProxy Package
Summary
ALSA-2025:21691: Important: haproxy security update. Affects haproxy versions < 3.0.5-4.el10_1.1. Fixed in 3.0.5-4.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAProxy is a widely used open-source software that provides a reliable, high-performance network load balancer for TCP and HTTP-based applications. It is known for its ability to handle a large number of concurrent connections and offers features such as SSL termination, health checks, and session persistence. However, it has been identified that a vulnerability exists in the mjson library used by HAProxy, which could potentially lead to a denial of service.
Vulnerability Detail
The vulnerability identified as CVE-2025-11230 in HAProxy's mjson library allows an attacker to exploit the system, leading to a denial of service. This could occur when the library processes malformed JSON data, causing the application to crash or become unresponsive. The implications of this vulnerability are significant, as it could disrupt services relying on HAProxy for load balancing, affecting the availability of applications and services.
How To Fix
Minimum fixed version
3.0.5-4.el10_1.1
This is the first release that contains the fix.
sudo dnf update haproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement input validation to filter out malformed JSON data before it reaches the HAProxy mjson library. This can help reduce the risk of triggering the denial of service condition.
Conclusion
The identified denial of service vulnerability in the HAProxy package poses a significant risk to applications relying on it for load balancing. Users are strongly advised to update to the patched version to ensure the security and availability of their services. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for haproxy →
FAQ
CVE-2025-11230 is a denial of service vulnerability found in the mjson library of HAProxy, which can cause the application to crash when processing malformed JSON data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to service disruptions, making applications reliant on HAProxy unavailable to users.
Yes, a patch is available. Users should update to HAProxy version 3.0.5-4.el10_1.1 or later to fix the vulnerability.
If immediate updating is not possible, implement input validation to filter out malformed JSON data as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
