Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-11230 (GCVE-0-2025-11230)
Vulnerability from cvelistv5 – Published: 2025-11-19 09:28 – Updated: 2025-11-19 17:09
VLAI?
EPSS
Summary
Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.
Severity ?
7.5 (High)
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| HAProxy Technologies | HAProxy Community Edition |
Affected:
2.4.0 , < 2.4.30
(semver)
Affected: 2.6.0 , < 2.6.23 (semver) Affected: 2.8.0 , < 2.8.16 (semver) Affected: 3.0.0 , < 3.0.12 (semver) Affected: 3.1.0 , < 3.1.9 (semver) Affected: 3.2.0 , < 3.2.6 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11230",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-19T17:06:27.675545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T17:09:15.642Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HAProxy Community Edition",
"programFiles": [
"src/mjson.c"
],
"repo": "https://git.haproxy.org/",
"vendor": "HAProxy Technologies",
"versions": [
{
"lessThan": "2.4.30",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
},
{
"lessThan": "2.6.23",
"status": "affected",
"version": "2.6.0",
"versionType": "semver"
},
{
"lessThan": "2.8.16",
"status": "affected",
"version": "2.8.0",
"versionType": "semver"
},
{
"lessThan": "3.0.12",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
},
{
"lessThan": "3.1.9",
"status": "affected",
"version": "3.1.0",
"versionType": "semver"
},
{
"lessThan": "3.2.6",
"status": "affected",
"version": "3.2.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests."
}
],
"value": "Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407 Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T09:28:39.750Z",
"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"shortName": "canonical"
},
"references": [
{
"url": "https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Denial of service vulnerability in HAProxy mjson library"
}
},
"cveMetadata": {
"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"assignerShortName": "canonical",
"cveId": "CVE-2025-11230",
"datePublished": "2025-11-19T09:28:39.750Z",
"dateReserved": "2025-10-01T13:10:26.249Z",
"dateUpdated": "2025-11-19T17:09:15.642Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-11230\",\"sourceIdentifier\":\"security@ubuntu.com\",\"published\":\"2025-11-19T10:15:45.020\",\"lastModified\":\"2025-11-19T19:14:59.327\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@ubuntu.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@ubuntu.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-407\"}]}],\"references\":[{\"url\":\"https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability\",\"source\":\"security@ubuntu.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-11230\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-11-19T17:06:27.675545Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-11-19T17:09:02.607Z\"}}], \"cna\": {\"title\": \"Denial of service vulnerability in HAProxy mjson library\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130 Excessive Allocation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://git.haproxy.org/\", \"vendor\": \"HAProxy Technologies\", \"product\": \"HAProxy Community Edition\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.4.0\", \"lessThan\": \"2.4.30\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"2.6.0\", \"lessThan\": \"2.6.23\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"2.8.0\", \"lessThan\": \"2.8.16\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.0.12\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.1.0\", \"lessThan\": \"3.1.9\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.2.0\", \"lessThan\": \"3.2.6\", \"versionType\": \"semver\"}], \"programFiles\": [\"src/mjson.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-407\", \"description\": \"CWE-407 Inefficient Algorithmic Complexity\"}]}], \"providerMetadata\": {\"orgId\": \"cc1ad9ee-3454-478d-9317-d3e869d708bc\", \"shortName\": \"canonical\", \"dateUpdated\": \"2025-11-19T09:28:39.750Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-11230\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-19T17:09:15.642Z\", \"dateReserved\": \"2025-10-01T13:10:26.249Z\", \"assignerOrgId\": \"cc1ad9ee-3454-478d-9317-d3e869d708bc\", \"datePublished\": \"2025-11-19T09:28:39.750Z\", \"assignerShortName\": \"canonical\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
MSRC_CVE-2025-11230
Vulnerability from csaf_microsoft - Published: 2025-11-02 00:00 - Updated: 2025-11-25 01:39Summary
Denial of service vulnerability in HAProxy mjson library
Notes
Additional Resources
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Disclaimer
The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
{
"document": {
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2025-11230 Denial of service vulnerability in HAProxy mjson library - VEX",
"url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-11230.json"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "Denial of service vulnerability in HAProxy mjson library",
"tracking": {
"current_release_date": "2025-11-25T01:39:17.000Z",
"generator": {
"date": "2025-12-03T22:59:15.059Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2025-11230",
"initial_release_date": "2025-11-02T00:00:00.000Z",
"revision_history": [
{
"date": "2025-11-21T01:03:35.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
},
{
"date": "2025-11-22T14:36:09.000Z",
"legacy_version": "2",
"number": "2",
"summary": "Information published."
},
{
"date": "2025-11-25T01:39:17.000Z",
"legacy_version": "3",
"number": "3",
"summary": "Information published."
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "2.0",
"product": {
"name": "CBL Mariner 2.0",
"product_id": "17086"
}
},
{
"category": "product_version",
"name": "3.0",
"product": {
"name": "Azure Linux 3.0",
"product_id": "17084"
}
}
],
"category": "product_name",
"name": "Azure Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003ccbl2 haproxy 2.4.24-1",
"product": {
"name": "\u003ccbl2 haproxy 2.4.24-1",
"product_id": "2"
}
},
{
"category": "product_version",
"name": "cbl2 haproxy 2.4.24-1",
"product": {
"name": "cbl2 haproxy 2.4.24-1",
"product_id": "17219"
}
},
{
"category": "product_version_range",
"name": "\u003cazl3 haproxy 2.9.11-3",
"product": {
"name": "\u003cazl3 haproxy 2.9.11-3",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "azl3 haproxy 2.9.11-3",
"product": {
"name": "azl3 haproxy 2.9.11-3",
"product_id": "19452"
}
}
],
"category": "product_name",
"name": "haproxy"
}
],
"category": "vendor",
"name": "Microsoft"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 haproxy 2.4.24-1 as a component of CBL Mariner 2.0",
"product_id": "17086-2"
},
"product_reference": "2",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 haproxy 2.4.24-1 as a component of CBL Mariner 2.0",
"product_id": "17219-17086"
},
"product_reference": "17219",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003cazl3 haproxy 2.9.11-3 as a component of Azure Linux 3.0",
"product_id": "17084-1"
},
"product_reference": "1",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 haproxy 2.9.11-3 as a component of Azure Linux 3.0",
"product_id": "19452-17084"
},
"product_reference": "19452",
"relates_to_product_reference": "17084"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11230",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"notes": [
{
"category": "general",
"text": "canonical",
"title": "Assigning CNA"
}
],
"product_status": {
"fixed": [
"17219-17086",
"19452-17084"
],
"known_affected": [
"17086-2",
"17084-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-11230 Denial of service vulnerability in HAProxy mjson library - VEX",
"url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-11230.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-21T01:03:35.000Z",
"details": "2.4.24-2:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-2"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2025-11-21T01:03:35.000Z",
"details": "2.9.11-4:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17084-1"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalsScore": 0.0,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"17086-2",
"17084-1"
]
}
],
"title": "Denial of service vulnerability in HAProxy mjson library"
}
]
}
CERTFR-2025-AVI-1064
Vulnerability from certfr_avis - Published: 2025-12-04 - Updated: 2025-12-04
De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | cbl2 cups 2.3.3op2-10 | ||
| Microsoft | N/A | cbl2 grub2 2.06-15 | ||
| Microsoft | N/A | cbl2 nodejs18 18.20.3-9 | ||
| Microsoft | N/A | cbl2 fluent-bit versions antérieures à 3.0.6-5 | ||
| Microsoft | N/A | azl3 kernel versions antérieures à 6.6.117.1-1 | ||
| Microsoft | N/A | azl3 kubevirt 1.5.0-5 | ||
| Microsoft | N/A | cbl2 python-tensorboard 2.11.0-3 | ||
| Microsoft | N/A | azl3 nodejs 20.14.0-9 | ||
| Microsoft | N/A | azl3 glib versions antérieures à 2.78.6-5 | ||
| Microsoft | N/A | azl3 grub2 2.06-25 | ||
| Microsoft | N/A | azl3 libxslt 1.1.43-1 | ||
| Microsoft | N/A | azl3 expat 2.6.4-2 | ||
| Microsoft | N/A | azl3 python-tensorboard 2.16.2-6 | ||
| Microsoft | N/A | cbl2 rsync versions antérieures à 3.4.1-2 | ||
| Microsoft | N/A | cbl2 libxslt 1.1.34-8 | ||
| Microsoft | N/A | azl3 cups 2.4.13-1 | ||
| Microsoft | N/A | cbl2 haproxy versions antérieures à 2.4.24-2 | ||
| Microsoft | N/A | cbl2 kernel 5.15.186.1-1 | ||
| Microsoft | N/A | azl3 libpng versions antérieures à 1.6.51-1 | ||
| Microsoft | N/A | azl3 haproxy versions antérieures à 2.9.11-4 | ||
| Microsoft | N/A | azl3 tensorflow 2.16.1-9 | ||
| Microsoft | N/A | azl3 fluent-bit 3.1.9-6 | ||
| Microsoft | N/A | azl3 rsync versions antérieures à 3.4.1-2 | ||
| Microsoft | N/A | azl3 keras 3.3.3-5 | ||
| Microsoft | N/A | cbl2 libpng versions antérieures à 1.6.51-1 | ||
| Microsoft | N/A | cbl2 glib versions antérieures à 2.71.0-8 | ||
| Microsoft | N/A | cbl2 kubevirt versions antérieures à 0.59.0-31 | ||
| Microsoft | N/A | azl3 libvirt versions antérieures à 10.0.0-6 | ||
| Microsoft | N/A | cbl2 reaper 3.1.1-19 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "cbl2 cups 2.3.3op2-10",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 grub2 2.06-15",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 nodejs18 18.20.3-9",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 fluent-bit versions ant\u00e9rieures \u00e0 3.0.6-5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 kernel versions ant\u00e9rieures \u00e0 6.6.117.1-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 kubevirt 1.5.0-5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 python-tensorboard 2.11.0-3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 nodejs 20.14.0-9",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 glib versions ant\u00e9rieures \u00e0 2.78.6-5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 grub2 2.06-25",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 libxslt 1.1.43-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 expat 2.6.4-2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 python-tensorboard 2.16.2-6",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 rsync versions ant\u00e9rieures \u00e0 3.4.1-2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 libxslt 1.1.34-8",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 cups 2.4.13-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 haproxy versions ant\u00e9rieures \u00e0 2.4.24-2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 kernel 5.15.186.1-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 libpng versions ant\u00e9rieures \u00e0 1.6.51-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 haproxy versions ant\u00e9rieures \u00e0 2.9.11-4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 tensorflow 2.16.1-9",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 fluent-bit 3.1.9-6",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 rsync versions ant\u00e9rieures \u00e0 3.4.1-2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 keras 3.3.3-5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 libpng versions ant\u00e9rieures \u00e0 1.6.51-1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 glib versions ant\u00e9rieures \u00e0 2.71.0-8",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 kubevirt versions ant\u00e9rieures \u00e0 0.59.0-31",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 libvirt versions ant\u00e9rieures \u00e0 10.0.0-6",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 reaper 3.1.1-19",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-58436",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58436"
},
{
"name": "CVE-2025-12816",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12816"
},
{
"name": "CVE-2025-11731",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11731"
},
{
"name": "CVE-2025-13226",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13226"
},
{
"name": "CVE-2025-13193",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13193"
},
{
"name": "CVE-2025-54770",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-54770"
},
{
"name": "CVE-2025-61915",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61915"
},
{
"name": "CVE-2025-61662",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61662"
},
{
"name": "CVE-2025-66031",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66031"
},
{
"name": "CVE-2025-12977",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12977"
},
{
"name": "CVE-2025-64505",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64505"
},
{
"name": "CVE-2025-61663",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61663"
},
{
"name": "CVE-2025-66382",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66382"
},
{
"name": "CVE-2025-12970",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12970"
},
{
"name": "CVE-2025-12638",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12638"
},
{
"name": "CVE-2025-64506",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64506"
},
{
"name": "CVE-2025-38656",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38656"
},
{
"name": "CVE-2025-64720",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64720"
},
{
"name": "CVE-2025-40210",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40210"
},
{
"name": "CVE-2025-66030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66030"
},
{
"name": "CVE-2025-64704",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64704"
},
{
"name": "CVE-2025-65018",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-65018"
},
{
"name": "CVE-2025-10158",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10158"
},
{
"name": "CVE-2025-64713",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64713"
},
{
"name": "CVE-2025-66221",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66221"
},
{
"name": "CVE-2025-13230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13230"
},
{
"name": "CVE-2025-13601",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13601"
},
{
"name": "CVE-2025-54771",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-54771"
},
{
"name": "CVE-2025-40211",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40211"
},
{
"name": "CVE-2025-13227",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13227"
},
{
"name": "CVE-2025-64324",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64324"
},
{
"name": "CVE-2025-12969",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12969"
},
{
"name": "CVE-2025-11230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11230"
},
{
"name": "CVE-2025-61661",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61661"
},
{
"name": "CVE-2022-50233",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-50233"
},
{
"name": "CVE-2025-61664",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61664"
}
],
"initial_release_date": "2025-12-04T00:00:00",
"last_revision_date": "2025-12-04T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-1064",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-12-04T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Microsoft. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": "2025-11-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-61661",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-61661"
},
{
"published_at": "2025-11-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-13230",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-13230"
},
{
"published_at": "2025-11-22",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-40210",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40210"
},
{
"published_at": "2025-11-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-13227",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-13227"
},
{
"published_at": "2025-11-30",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-61915",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-61915"
},
{
"published_at": "2025-11-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-64720",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64720"
},
{
"published_at": "2025-11-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-12816",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-12816"
},
{
"published_at": "2025-11-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-64704",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64704"
},
{
"published_at": "2025-11-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-54770",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54770"
},
{
"published_at": "2025-11-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-11731",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-11731"
},
{
"published_at": "2025-12-03",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-66221",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-66221"
},
{
"published_at": "2025-11-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-13601",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-13601"
},
{
"published_at": "2025-11-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-64713",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64713"
},
{
"published_at": "2025-11-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-65018",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-65018"
},
{
"published_at": "2025-11-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-66030",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-66030"
},
{
"published_at": "2025-11-22",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-40211",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40211"
},
{
"published_at": "2025-11-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-50233",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-50233"
},
{
"published_at": "2025-11-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-66382",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-66382"
},
{
"published_at": "2025-11-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-61664",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-61664"
},
{
"published_at": "2025-11-30",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-58436",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-58436"
},
{
"published_at": "2025-11-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-13193",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-13193"
},
{
"published_at": "2025-11-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-61662",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-61662"
},
{
"published_at": "2025-11-28",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-38656",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-38656"
},
{
"published_at": "2025-11-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-11230",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-11230"
},
{
"published_at": "2025-11-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-54771",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54771"
},
{
"published_at": "2025-11-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-13226",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-13226"
},
{
"published_at": "2025-12-03",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-12638",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-12638"
},
{
"published_at": "2025-11-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-12970",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-12970"
},
{
"published_at": "2025-11-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-66031",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-66031"
},
{
"published_at": "2025-11-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-12977",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-12977"
},
{
"published_at": "2025-11-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-61663",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-61663"
},
{
"published_at": "2025-11-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-12969",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-12969"
},
{
"published_at": "2025-11-20",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-64324",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64324"
},
{
"published_at": "2025-11-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-64506",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64506"
},
{
"published_at": "2025-11-19",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-10158",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-10158"
},
{
"published_at": "2025-11-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-64505",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64505"
}
]
}
RHSA-2025:21692
Vulnerability from csaf_redhat - Published: 2025-11-18 13:44 - Updated: 2025-12-02 06:46Summary
Red Hat Security Advisory: haproxy security update
Notes
Topic
An update for haproxy is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.
Security Fix(es):
* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for haproxy is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:21692",
"url": "https://access.redhat.com/errata/RHSA-2025:21692"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21692.json"
}
],
"title": "Red Hat Security Advisory: haproxy security update",
"tracking": {
"current_release_date": "2025-12-02T06:46:19+00:00",
"generator": {
"date": "2025-12-02T06:46:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.13"
}
},
"id": "RHSA-2025:21692",
"initial_release_date": "2025-11-18T13:44:31+00:00",
"revision_history": [
{
"date": "2025-11-18T13:44:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-11-18T13:44:31+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-02T06:46:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:3.0.5-4.el10_0.1.src",
"product": {
"name": "haproxy-0:3.0.5-4.el10_0.1.src",
"product_id": "haproxy-0:3.0.5-4.el10_0.1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@3.0.5-4.el10_0.1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:3.0.5-4.el10_0.1.aarch64",
"product": {
"name": "haproxy-0:3.0.5-4.el10_0.1.aarch64",
"product_id": "haproxy-0:3.0.5-4.el10_0.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@3.0.5-4.el10_0.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:3.0.5-4.el10_0.1.aarch64",
"product": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_0.1.aarch64",
"product_id": "haproxy-debugsource-0:3.0.5-4.el10_0.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@3.0.5-4.el10_0.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.aarch64",
"product": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.aarch64",
"product_id": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@3.0.5-4.el10_0.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:3.0.5-4.el10_0.1.ppc64le",
"product": {
"name": "haproxy-0:3.0.5-4.el10_0.1.ppc64le",
"product_id": "haproxy-0:3.0.5-4.el10_0.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@3.0.5-4.el10_0.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:3.0.5-4.el10_0.1.ppc64le",
"product": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_0.1.ppc64le",
"product_id": "haproxy-debugsource-0:3.0.5-4.el10_0.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@3.0.5-4.el10_0.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.ppc64le",
"product": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.ppc64le",
"product_id": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@3.0.5-4.el10_0.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:3.0.5-4.el10_0.1.x86_64",
"product": {
"name": "haproxy-0:3.0.5-4.el10_0.1.x86_64",
"product_id": "haproxy-0:3.0.5-4.el10_0.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@3.0.5-4.el10_0.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:3.0.5-4.el10_0.1.x86_64",
"product": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_0.1.x86_64",
"product_id": "haproxy-debugsource-0:3.0.5-4.el10_0.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@3.0.5-4.el10_0.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.x86_64",
"product": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.x86_64",
"product_id": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@3.0.5-4.el10_0.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:3.0.5-4.el10_0.1.s390x",
"product": {
"name": "haproxy-0:3.0.5-4.el10_0.1.s390x",
"product_id": "haproxy-0:3.0.5-4.el10_0.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@3.0.5-4.el10_0.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:3.0.5-4.el10_0.1.s390x",
"product": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_0.1.s390x",
"product_id": "haproxy-debugsource-0:3.0.5-4.el10_0.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@3.0.5-4.el10_0.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.s390x",
"product": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.s390x",
"product_id": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@3.0.5-4.el10_0.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:3.0.5-4.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.aarch64"
},
"product_reference": "haproxy-0:3.0.5-4.el10_0.1.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:3.0.5-4.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.ppc64le"
},
"product_reference": "haproxy-0:3.0.5-4.el10_0.1.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:3.0.5-4.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.s390x"
},
"product_reference": "haproxy-0:3.0.5-4.el10_0.1.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:3.0.5-4.el10_0.1.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.src"
},
"product_reference": "haproxy-0:3.0.5-4.el10_0.1.src",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:3.0.5-4.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.x86_64"
},
"product_reference": "haproxy-0:3.0.5-4.el10_0.1.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.aarch64"
},
"product_reference": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.ppc64le"
},
"product_reference": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.s390x"
},
"product_reference": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.x86_64"
},
"product_reference": "haproxy-debuginfo-0:3.0.5-4.el10_0.1.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.aarch64"
},
"product_reference": "haproxy-debugsource-0:3.0.5-4.el10_0.1.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.ppc64le"
},
"product_reference": "haproxy-debugsource-0:3.0.5-4.el10_0.1.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.s390x"
},
"product_reference": "haproxy-debugsource-0:3.0.5-4.el10_0.1.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.x86_64"
},
"product_reference": "haproxy-debugsource-0:3.0.5-4.el10_0.1.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11230",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-11-06T03:09:28.529000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2413003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in haproxy. A stemming from an inefficient algorithmic complexity issue within its bundled mjson parsing library. This vulnerability is triggered when haproxy is configured to analyze JSON content, such as with the json_query or jwt_payload_query function",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "haproxy: denial of service vulnerability in HAProxy mjson library",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.aarch64",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.ppc64le",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.s390x",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.src",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.x86_64",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.aarch64",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.ppc64le",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.s390x",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.x86_64",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.aarch64",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.ppc64le",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.s390x",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-11230"
},
{
"category": "external",
"summary": "RHBZ#2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-11230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230"
}
],
"release_date": "2025-10-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-18T13:44:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.aarch64",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.ppc64le",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.s390x",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.src",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.x86_64",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.aarch64",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.ppc64le",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.s390x",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.x86_64",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.aarch64",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.ppc64le",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.s390x",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:21692"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.aarch64",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.ppc64le",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.s390x",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.src",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.x86_64",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.aarch64",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.ppc64le",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.s390x",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.x86_64",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.aarch64",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.ppc64le",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.s390x",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.aarch64",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.ppc64le",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.s390x",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.src",
"AppStream-10.0.Z.E2S:haproxy-0:3.0.5-4.el10_0.1.x86_64",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.aarch64",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.ppc64le",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.s390x",
"AppStream-10.0.Z.E2S:haproxy-debuginfo-0:3.0.5-4.el10_0.1.x86_64",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.aarch64",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.ppc64le",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.s390x",
"AppStream-10.0.Z.E2S:haproxy-debugsource-0:3.0.5-4.el10_0.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "haproxy: denial of service vulnerability in HAProxy mjson library"
}
]
}
RHSA-2025:21693
Vulnerability from csaf_redhat - Published: 2025-11-18 13:56 - Updated: 2025-12-02 06:46Summary
Red Hat Security Advisory: haproxy security update
Notes
Topic
An update for haproxy is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.
Security Fix(es):
* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for haproxy is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:21693",
"url": "https://access.redhat.com/errata/RHSA-2025:21693"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21693.json"
}
],
"title": "Red Hat Security Advisory: haproxy security update",
"tracking": {
"current_release_date": "2025-12-02T06:46:22+00:00",
"generator": {
"date": "2025-12-02T06:46:22+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.13"
}
},
"id": "RHSA-2025:21693",
"initial_release_date": "2025-11-18T13:56:41+00:00",
"revision_history": [
{
"date": "2025-11-18T13:56:41+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-11-18T13:56:41+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-02T06:46:22+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.8.14-1.el9_7.1.src",
"product": {
"name": "haproxy-0:2.8.14-1.el9_7.1.src",
"product_id": "haproxy-0:2.8.14-1.el9_7.1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.8.14-1.el9_7.1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.8.14-1.el9_7.1.aarch64",
"product": {
"name": "haproxy-0:2.8.14-1.el9_7.1.aarch64",
"product_id": "haproxy-0:2.8.14-1.el9_7.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.8.14-1.el9_7.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.8.14-1.el9_7.1.aarch64",
"product": {
"name": "haproxy-debugsource-0:2.8.14-1.el9_7.1.aarch64",
"product_id": "haproxy-debugsource-0:2.8.14-1.el9_7.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.8.14-1.el9_7.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.aarch64",
"product": {
"name": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.aarch64",
"product_id": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.8.14-1.el9_7.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.8.14-1.el9_7.1.ppc64le",
"product": {
"name": "haproxy-0:2.8.14-1.el9_7.1.ppc64le",
"product_id": "haproxy-0:2.8.14-1.el9_7.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.8.14-1.el9_7.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.8.14-1.el9_7.1.ppc64le",
"product": {
"name": "haproxy-debugsource-0:2.8.14-1.el9_7.1.ppc64le",
"product_id": "haproxy-debugsource-0:2.8.14-1.el9_7.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.8.14-1.el9_7.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.ppc64le",
"product": {
"name": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.ppc64le",
"product_id": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.8.14-1.el9_7.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.8.14-1.el9_7.1.x86_64",
"product": {
"name": "haproxy-0:2.8.14-1.el9_7.1.x86_64",
"product_id": "haproxy-0:2.8.14-1.el9_7.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.8.14-1.el9_7.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.8.14-1.el9_7.1.x86_64",
"product": {
"name": "haproxy-debugsource-0:2.8.14-1.el9_7.1.x86_64",
"product_id": "haproxy-debugsource-0:2.8.14-1.el9_7.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.8.14-1.el9_7.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.x86_64",
"product": {
"name": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.x86_64",
"product_id": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.8.14-1.el9_7.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.8.14-1.el9_7.1.s390x",
"product": {
"name": "haproxy-0:2.8.14-1.el9_7.1.s390x",
"product_id": "haproxy-0:2.8.14-1.el9_7.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.8.14-1.el9_7.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.8.14-1.el9_7.1.s390x",
"product": {
"name": "haproxy-debugsource-0:2.8.14-1.el9_7.1.s390x",
"product_id": "haproxy-debugsource-0:2.8.14-1.el9_7.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.8.14-1.el9_7.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.s390x",
"product": {
"name": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.s390x",
"product_id": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.8.14-1.el9_7.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.8.14-1.el9_7.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.aarch64"
},
"product_reference": "haproxy-0:2.8.14-1.el9_7.1.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.8.14-1.el9_7.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.ppc64le"
},
"product_reference": "haproxy-0:2.8.14-1.el9_7.1.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.8.14-1.el9_7.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.s390x"
},
"product_reference": "haproxy-0:2.8.14-1.el9_7.1.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.8.14-1.el9_7.1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.src"
},
"product_reference": "haproxy-0:2.8.14-1.el9_7.1.src",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.8.14-1.el9_7.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.x86_64"
},
"product_reference": "haproxy-0:2.8.14-1.el9_7.1.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.aarch64"
},
"product_reference": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.ppc64le"
},
"product_reference": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.s390x"
},
"product_reference": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.x86_64"
},
"product_reference": "haproxy-debuginfo-0:2.8.14-1.el9_7.1.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.8.14-1.el9_7.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.aarch64"
},
"product_reference": "haproxy-debugsource-0:2.8.14-1.el9_7.1.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.8.14-1.el9_7.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.ppc64le"
},
"product_reference": "haproxy-debugsource-0:2.8.14-1.el9_7.1.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.8.14-1.el9_7.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.s390x"
},
"product_reference": "haproxy-debugsource-0:2.8.14-1.el9_7.1.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.8.14-1.el9_7.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.x86_64"
},
"product_reference": "haproxy-debugsource-0:2.8.14-1.el9_7.1.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11230",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-11-06T03:09:28.529000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2413003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in haproxy. A stemming from an inefficient algorithmic complexity issue within its bundled mjson parsing library. This vulnerability is triggered when haproxy is configured to analyze JSON content, such as with the json_query or jwt_payload_query function",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "haproxy: denial of service vulnerability in HAProxy mjson library",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-11230"
},
{
"category": "external",
"summary": "RHBZ#2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-11230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230"
}
],
"release_date": "2025-10-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-18T13:56:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:21693"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:haproxy-0:2.8.14-1.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:haproxy-debuginfo-0:2.8.14-1.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:haproxy-debugsource-0:2.8.14-1.el9_7.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "haproxy: denial of service vulnerability in HAProxy mjson library"
}
]
}
RHSA-2025:22399
Vulnerability from csaf_redhat - Published: 2025-12-01 10:00 - Updated: 2025-12-02 06:46Summary
Red Hat Security Advisory: haproxy security update
Notes
Topic
An update for haproxy is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.
Security Fix(es):
* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for haproxy is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:22399",
"url": "https://access.redhat.com/errata/RHSA-2025:22399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22399.json"
}
],
"title": "Red Hat Security Advisory: haproxy security update",
"tracking": {
"current_release_date": "2025-12-02T06:46:26+00:00",
"generator": {
"date": "2025-12-02T06:46:26+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.13"
}
},
"id": "RHSA-2025:22399",
"initial_release_date": "2025-12-01T10:00:22+00:00",
"revision_history": [
{
"date": "2025-12-01T10:00:22+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-01T10:00:22+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-02T06:46:26+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:9.4::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.22-3.el9_4.1.s390x",
"product": {
"name": "haproxy-0:2.4.22-3.el9_4.1.s390x",
"product_id": "haproxy-0:2.4.22-3.el9_4.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.22-3.el9_4.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.22-3.el9_4.1.s390x",
"product": {
"name": "haproxy-debugsource-0:2.4.22-3.el9_4.1.s390x",
"product_id": "haproxy-debugsource-0:2.4.22-3.el9_4.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.22-3.el9_4.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.s390x",
"product": {
"name": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.s390x",
"product_id": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.22-3.el9_4.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.22-3.el9_4.1.src",
"product": {
"name": "haproxy-0:2.4.22-3.el9_4.1.src",
"product_id": "haproxy-0:2.4.22-3.el9_4.1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.22-3.el9_4.1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.22-3.el9_4.1.aarch64",
"product": {
"name": "haproxy-0:2.4.22-3.el9_4.1.aarch64",
"product_id": "haproxy-0:2.4.22-3.el9_4.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.22-3.el9_4.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.22-3.el9_4.1.aarch64",
"product": {
"name": "haproxy-debugsource-0:2.4.22-3.el9_4.1.aarch64",
"product_id": "haproxy-debugsource-0:2.4.22-3.el9_4.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.22-3.el9_4.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.aarch64",
"product": {
"name": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.aarch64",
"product_id": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.22-3.el9_4.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.22-3.el9_4.1.ppc64le",
"product": {
"name": "haproxy-0:2.4.22-3.el9_4.1.ppc64le",
"product_id": "haproxy-0:2.4.22-3.el9_4.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.22-3.el9_4.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.22-3.el9_4.1.ppc64le",
"product": {
"name": "haproxy-debugsource-0:2.4.22-3.el9_4.1.ppc64le",
"product_id": "haproxy-debugsource-0:2.4.22-3.el9_4.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.22-3.el9_4.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.ppc64le",
"product": {
"name": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.ppc64le",
"product_id": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.22-3.el9_4.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.22-3.el9_4.1.x86_64",
"product": {
"name": "haproxy-0:2.4.22-3.el9_4.1.x86_64",
"product_id": "haproxy-0:2.4.22-3.el9_4.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.22-3.el9_4.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.22-3.el9_4.1.x86_64",
"product": {
"name": "haproxy-debugsource-0:2.4.22-3.el9_4.1.x86_64",
"product_id": "haproxy-debugsource-0:2.4.22-3.el9_4.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.22-3.el9_4.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.x86_64",
"product": {
"name": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.x86_64",
"product_id": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.22-3.el9_4.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.22-3.el9_4.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.aarch64"
},
"product_reference": "haproxy-0:2.4.22-3.el9_4.1.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.22-3.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.ppc64le"
},
"product_reference": "haproxy-0:2.4.22-3.el9_4.1.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.22-3.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.s390x"
},
"product_reference": "haproxy-0:2.4.22-3.el9_4.1.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.22-3.el9_4.1.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.src"
},
"product_reference": "haproxy-0:2.4.22-3.el9_4.1.src",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.22-3.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.x86_64"
},
"product_reference": "haproxy-0:2.4.22-3.el9_4.1.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.aarch64"
},
"product_reference": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.ppc64le"
},
"product_reference": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.s390x"
},
"product_reference": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.x86_64"
},
"product_reference": "haproxy-debuginfo-0:2.4.22-3.el9_4.1.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.22-3.el9_4.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.aarch64"
},
"product_reference": "haproxy-debugsource-0:2.4.22-3.el9_4.1.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.22-3.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.ppc64le"
},
"product_reference": "haproxy-debugsource-0:2.4.22-3.el9_4.1.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.22-3.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.s390x"
},
"product_reference": "haproxy-debugsource-0:2.4.22-3.el9_4.1.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.22-3.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.x86_64"
},
"product_reference": "haproxy-debugsource-0:2.4.22-3.el9_4.1.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11230",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-11-06T03:09:28.529000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2413003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in haproxy. A stemming from an inefficient algorithmic complexity issue within its bundled mjson parsing library. This vulnerability is triggered when haproxy is configured to analyze JSON content, such as with the json_query or jwt_payload_query function",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "haproxy: denial of service vulnerability in HAProxy mjson library",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.aarch64",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.s390x",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.src",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.x86_64",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.aarch64",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.s390x",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.x86_64",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.aarch64",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.s390x",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-11230"
},
{
"category": "external",
"summary": "RHBZ#2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-11230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230"
}
],
"release_date": "2025-10-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-01T10:00:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.aarch64",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.s390x",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.src",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.x86_64",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.aarch64",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.s390x",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.x86_64",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.aarch64",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.s390x",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.aarch64",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.s390x",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.src",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.x86_64",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.aarch64",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.s390x",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.x86_64",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.aarch64",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.s390x",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.aarch64",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.s390x",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.src",
"AppStream-9.4.0.Z.EUS:haproxy-0:2.4.22-3.el9_4.1.x86_64",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.aarch64",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.s390x",
"AppStream-9.4.0.Z.EUS:haproxy-debuginfo-0:2.4.22-3.el9_4.1.x86_64",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.aarch64",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.s390x",
"AppStream-9.4.0.Z.EUS:haproxy-debugsource-0:2.4.22-3.el9_4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "haproxy: denial of service vulnerability in HAProxy mjson library"
}
]
}
RHSA-2025:21694
Vulnerability from csaf_redhat - Published: 2025-11-18 14:01 - Updated: 2025-12-02 06:46Summary
Red Hat Security Advisory: haproxy security update
Notes
Topic
An update for haproxy is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.
Security Fix(es):
* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for haproxy is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:21694",
"url": "https://access.redhat.com/errata/RHSA-2025:21694"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21694.json"
}
],
"title": "Red Hat Security Advisory: haproxy security update",
"tracking": {
"current_release_date": "2025-12-02T06:46:23+00:00",
"generator": {
"date": "2025-12-02T06:46:23+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.13"
}
},
"id": "RHSA-2025:21694",
"initial_release_date": "2025-11-18T14:01:06+00:00",
"revision_history": [
{
"date": "2025-11-18T14:01:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-11-18T14:01:06+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-02T06:46:23+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:9.6::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.22-4.el9_6.1.src",
"product": {
"name": "haproxy-0:2.4.22-4.el9_6.1.src",
"product_id": "haproxy-0:2.4.22-4.el9_6.1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.22-4.el9_6.1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.22-4.el9_6.1.aarch64",
"product": {
"name": "haproxy-0:2.4.22-4.el9_6.1.aarch64",
"product_id": "haproxy-0:2.4.22-4.el9_6.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.22-4.el9_6.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.22-4.el9_6.1.aarch64",
"product": {
"name": "haproxy-debugsource-0:2.4.22-4.el9_6.1.aarch64",
"product_id": "haproxy-debugsource-0:2.4.22-4.el9_6.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.22-4.el9_6.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.aarch64",
"product": {
"name": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.aarch64",
"product_id": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.22-4.el9_6.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.22-4.el9_6.1.ppc64le",
"product": {
"name": "haproxy-0:2.4.22-4.el9_6.1.ppc64le",
"product_id": "haproxy-0:2.4.22-4.el9_6.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.22-4.el9_6.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.22-4.el9_6.1.ppc64le",
"product": {
"name": "haproxy-debugsource-0:2.4.22-4.el9_6.1.ppc64le",
"product_id": "haproxy-debugsource-0:2.4.22-4.el9_6.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.22-4.el9_6.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.ppc64le",
"product": {
"name": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.ppc64le",
"product_id": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.22-4.el9_6.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.22-4.el9_6.1.x86_64",
"product": {
"name": "haproxy-0:2.4.22-4.el9_6.1.x86_64",
"product_id": "haproxy-0:2.4.22-4.el9_6.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.22-4.el9_6.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.22-4.el9_6.1.x86_64",
"product": {
"name": "haproxy-debugsource-0:2.4.22-4.el9_6.1.x86_64",
"product_id": "haproxy-debugsource-0:2.4.22-4.el9_6.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.22-4.el9_6.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.x86_64",
"product": {
"name": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.x86_64",
"product_id": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.22-4.el9_6.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.22-4.el9_6.1.s390x",
"product": {
"name": "haproxy-0:2.4.22-4.el9_6.1.s390x",
"product_id": "haproxy-0:2.4.22-4.el9_6.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.22-4.el9_6.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.22-4.el9_6.1.s390x",
"product": {
"name": "haproxy-debugsource-0:2.4.22-4.el9_6.1.s390x",
"product_id": "haproxy-debugsource-0:2.4.22-4.el9_6.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.22-4.el9_6.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.s390x",
"product": {
"name": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.s390x",
"product_id": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.22-4.el9_6.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.22-4.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.aarch64"
},
"product_reference": "haproxy-0:2.4.22-4.el9_6.1.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.22-4.el9_6.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.ppc64le"
},
"product_reference": "haproxy-0:2.4.22-4.el9_6.1.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.22-4.el9_6.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.s390x"
},
"product_reference": "haproxy-0:2.4.22-4.el9_6.1.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.22-4.el9_6.1.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.src"
},
"product_reference": "haproxy-0:2.4.22-4.el9_6.1.src",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.22-4.el9_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.x86_64"
},
"product_reference": "haproxy-0:2.4.22-4.el9_6.1.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.aarch64"
},
"product_reference": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.ppc64le"
},
"product_reference": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.s390x"
},
"product_reference": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.x86_64"
},
"product_reference": "haproxy-debuginfo-0:2.4.22-4.el9_6.1.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.22-4.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.aarch64"
},
"product_reference": "haproxy-debugsource-0:2.4.22-4.el9_6.1.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.22-4.el9_6.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.ppc64le"
},
"product_reference": "haproxy-debugsource-0:2.4.22-4.el9_6.1.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.22-4.el9_6.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.s390x"
},
"product_reference": "haproxy-debugsource-0:2.4.22-4.el9_6.1.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.22-4.el9_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.x86_64"
},
"product_reference": "haproxy-debugsource-0:2.4.22-4.el9_6.1.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11230",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-11-06T03:09:28.529000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2413003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in haproxy. A stemming from an inefficient algorithmic complexity issue within its bundled mjson parsing library. This vulnerability is triggered when haproxy is configured to analyze JSON content, such as with the json_query or jwt_payload_query function",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "haproxy: denial of service vulnerability in HAProxy mjson library",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.aarch64",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.ppc64le",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.s390x",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.src",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.x86_64",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.aarch64",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.ppc64le",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.s390x",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.x86_64",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.aarch64",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.ppc64le",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.s390x",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-11230"
},
{
"category": "external",
"summary": "RHBZ#2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-11230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230"
}
],
"release_date": "2025-10-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-18T14:01:06+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.aarch64",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.ppc64le",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.s390x",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.src",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.x86_64",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.aarch64",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.ppc64le",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.s390x",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.x86_64",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.aarch64",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.ppc64le",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.s390x",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:21694"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.aarch64",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.ppc64le",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.s390x",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.src",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.x86_64",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.aarch64",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.ppc64le",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.s390x",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.x86_64",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.aarch64",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.ppc64le",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.s390x",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.aarch64",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.ppc64le",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.s390x",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.src",
"AppStream-9.6.0.Z.EUS:haproxy-0:2.4.22-4.el9_6.1.x86_64",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.aarch64",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.ppc64le",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.s390x",
"AppStream-9.6.0.Z.EUS:haproxy-debuginfo-0:2.4.22-4.el9_6.1.x86_64",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.aarch64",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.ppc64le",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.s390x",
"AppStream-9.6.0.Z.EUS:haproxy-debugsource-0:2.4.22-4.el9_6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "haproxy: denial of service vulnerability in HAProxy mjson library"
}
]
}
RHSA-2025:22422
Vulnerability from csaf_redhat - Published: 2025-12-01 13:15 - Updated: 2025-12-02 06:46Summary
Red Hat Security Advisory: haproxy security update
Notes
Topic
An update for haproxy is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.
Security Fix(es):
* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for haproxy is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:22422",
"url": "https://access.redhat.com/errata/RHSA-2025:22422"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22422.json"
}
],
"title": "Red Hat Security Advisory: haproxy security update",
"tracking": {
"current_release_date": "2025-12-02T06:46:27+00:00",
"generator": {
"date": "2025-12-02T06:46:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.13"
}
},
"id": "RHSA-2025:22422",
"initial_release_date": "2025-12-01T13:15:10+00:00",
"revision_history": [
{
"date": "2025-12-01T13:15:10+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-01T13:15:10+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-02T06:46:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:9.0::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.7-2.el9_0.3.src",
"product": {
"name": "haproxy-0:2.4.7-2.el9_0.3.src",
"product_id": "haproxy-0:2.4.7-2.el9_0.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.7-2.el9_0.3?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.7-2.el9_0.3.aarch64",
"product": {
"name": "haproxy-0:2.4.7-2.el9_0.3.aarch64",
"product_id": "haproxy-0:2.4.7-2.el9_0.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.7-2.el9_0.3?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.7-2.el9_0.3.aarch64",
"product": {
"name": "haproxy-debugsource-0:2.4.7-2.el9_0.3.aarch64",
"product_id": "haproxy-debugsource-0:2.4.7-2.el9_0.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.7-2.el9_0.3?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.aarch64",
"product": {
"name": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.aarch64",
"product_id": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.7-2.el9_0.3?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.7-2.el9_0.3.ppc64le",
"product": {
"name": "haproxy-0:2.4.7-2.el9_0.3.ppc64le",
"product_id": "haproxy-0:2.4.7-2.el9_0.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.7-2.el9_0.3?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.7-2.el9_0.3.ppc64le",
"product": {
"name": "haproxy-debugsource-0:2.4.7-2.el9_0.3.ppc64le",
"product_id": "haproxy-debugsource-0:2.4.7-2.el9_0.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.7-2.el9_0.3?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.ppc64le",
"product": {
"name": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.ppc64le",
"product_id": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.7-2.el9_0.3?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.7-2.el9_0.3.x86_64",
"product": {
"name": "haproxy-0:2.4.7-2.el9_0.3.x86_64",
"product_id": "haproxy-0:2.4.7-2.el9_0.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.7-2.el9_0.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.7-2.el9_0.3.x86_64",
"product": {
"name": "haproxy-debugsource-0:2.4.7-2.el9_0.3.x86_64",
"product_id": "haproxy-debugsource-0:2.4.7-2.el9_0.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.7-2.el9_0.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.x86_64",
"product": {
"name": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.x86_64",
"product_id": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.7-2.el9_0.3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.7-2.el9_0.3.s390x",
"product": {
"name": "haproxy-0:2.4.7-2.el9_0.3.s390x",
"product_id": "haproxy-0:2.4.7-2.el9_0.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.7-2.el9_0.3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.7-2.el9_0.3.s390x",
"product": {
"name": "haproxy-debugsource-0:2.4.7-2.el9_0.3.s390x",
"product_id": "haproxy-debugsource-0:2.4.7-2.el9_0.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.7-2.el9_0.3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.s390x",
"product": {
"name": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.s390x",
"product_id": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.7-2.el9_0.3?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.7-2.el9_0.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.aarch64"
},
"product_reference": "haproxy-0:2.4.7-2.el9_0.3.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.7-2.el9_0.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.ppc64le"
},
"product_reference": "haproxy-0:2.4.7-2.el9_0.3.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.7-2.el9_0.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.s390x"
},
"product_reference": "haproxy-0:2.4.7-2.el9_0.3.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.7-2.el9_0.3.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.src"
},
"product_reference": "haproxy-0:2.4.7-2.el9_0.3.src",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.7-2.el9_0.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.x86_64"
},
"product_reference": "haproxy-0:2.4.7-2.el9_0.3.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.aarch64"
},
"product_reference": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.ppc64le"
},
"product_reference": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.s390x"
},
"product_reference": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.x86_64"
},
"product_reference": "haproxy-debuginfo-0:2.4.7-2.el9_0.3.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.7-2.el9_0.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.aarch64"
},
"product_reference": "haproxy-debugsource-0:2.4.7-2.el9_0.3.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.7-2.el9_0.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.ppc64le"
},
"product_reference": "haproxy-debugsource-0:2.4.7-2.el9_0.3.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.7-2.el9_0.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.s390x"
},
"product_reference": "haproxy-debugsource-0:2.4.7-2.el9_0.3.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.7-2.el9_0.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.x86_64"
},
"product_reference": "haproxy-debugsource-0:2.4.7-2.el9_0.3.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11230",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-11-06T03:09:28.529000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2413003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in haproxy. A stemming from an inefficient algorithmic complexity issue within its bundled mjson parsing library. This vulnerability is triggered when haproxy is configured to analyze JSON content, such as with the json_query or jwt_payload_query function",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "haproxy: denial of service vulnerability in HAProxy mjson library",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.aarch64",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.ppc64le",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.s390x",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.src",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.x86_64",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.aarch64",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.ppc64le",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.s390x",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.x86_64",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.aarch64",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.ppc64le",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.s390x",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-11230"
},
{
"category": "external",
"summary": "RHBZ#2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-11230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230"
}
],
"release_date": "2025-10-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-01T13:15:10+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.aarch64",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.ppc64le",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.s390x",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.src",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.x86_64",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.aarch64",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.ppc64le",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.s390x",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.x86_64",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.aarch64",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.ppc64le",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.s390x",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22422"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.aarch64",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.ppc64le",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.s390x",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.src",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.x86_64",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.aarch64",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.ppc64le",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.s390x",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.x86_64",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.aarch64",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.ppc64le",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.s390x",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.aarch64",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.ppc64le",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.s390x",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.src",
"AppStream-9.0.0.Z.E4S:haproxy-0:2.4.7-2.el9_0.3.x86_64",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.aarch64",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.ppc64le",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.s390x",
"AppStream-9.0.0.Z.E4S:haproxy-debuginfo-0:2.4.7-2.el9_0.3.x86_64",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.aarch64",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.ppc64le",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.s390x",
"AppStream-9.0.0.Z.E4S:haproxy-debugsource-0:2.4.7-2.el9_0.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "haproxy: denial of service vulnerability in HAProxy mjson library"
}
]
}
RHSA-2025:22398
Vulnerability from csaf_redhat - Published: 2025-12-01 09:38 - Updated: 2025-12-02 06:46Summary
Red Hat Security Advisory: haproxy security update
Notes
Topic
An update for haproxy is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.
Security Fix(es):
* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for haproxy is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:22398",
"url": "https://access.redhat.com/errata/RHSA-2025:22398"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22398.json"
}
],
"title": "Red Hat Security Advisory: haproxy security update",
"tracking": {
"current_release_date": "2025-12-02T06:46:25+00:00",
"generator": {
"date": "2025-12-02T06:46:25+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.13"
}
},
"id": "RHSA-2025:22398",
"initial_release_date": "2025-12-01T09:38:18+00:00",
"revision_history": [
{
"date": "2025-12-01T09:38:18+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-01T09:38:18+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-02T06:46:25+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:9.2::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.17-6.el9_2.3.src",
"product": {
"name": "haproxy-0:2.4.17-6.el9_2.3.src",
"product_id": "haproxy-0:2.4.17-6.el9_2.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.17-6.el9_2.3?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.17-6.el9_2.3.aarch64",
"product": {
"name": "haproxy-0:2.4.17-6.el9_2.3.aarch64",
"product_id": "haproxy-0:2.4.17-6.el9_2.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.17-6.el9_2.3?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.17-6.el9_2.3.aarch64",
"product": {
"name": "haproxy-debugsource-0:2.4.17-6.el9_2.3.aarch64",
"product_id": "haproxy-debugsource-0:2.4.17-6.el9_2.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.17-6.el9_2.3?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.aarch64",
"product": {
"name": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.aarch64",
"product_id": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.17-6.el9_2.3?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.17-6.el9_2.3.ppc64le",
"product": {
"name": "haproxy-0:2.4.17-6.el9_2.3.ppc64le",
"product_id": "haproxy-0:2.4.17-6.el9_2.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.17-6.el9_2.3?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.17-6.el9_2.3.ppc64le",
"product": {
"name": "haproxy-debugsource-0:2.4.17-6.el9_2.3.ppc64le",
"product_id": "haproxy-debugsource-0:2.4.17-6.el9_2.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.17-6.el9_2.3?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.ppc64le",
"product": {
"name": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.ppc64le",
"product_id": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.17-6.el9_2.3?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.17-6.el9_2.3.x86_64",
"product": {
"name": "haproxy-0:2.4.17-6.el9_2.3.x86_64",
"product_id": "haproxy-0:2.4.17-6.el9_2.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.17-6.el9_2.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.17-6.el9_2.3.x86_64",
"product": {
"name": "haproxy-debugsource-0:2.4.17-6.el9_2.3.x86_64",
"product_id": "haproxy-debugsource-0:2.4.17-6.el9_2.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.17-6.el9_2.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.x86_64",
"product": {
"name": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.x86_64",
"product_id": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.17-6.el9_2.3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:2.4.17-6.el9_2.3.s390x",
"product": {
"name": "haproxy-0:2.4.17-6.el9_2.3.s390x",
"product_id": "haproxy-0:2.4.17-6.el9_2.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@2.4.17-6.el9_2.3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:2.4.17-6.el9_2.3.s390x",
"product": {
"name": "haproxy-debugsource-0:2.4.17-6.el9_2.3.s390x",
"product_id": "haproxy-debugsource-0:2.4.17-6.el9_2.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@2.4.17-6.el9_2.3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.s390x",
"product": {
"name": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.s390x",
"product_id": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@2.4.17-6.el9_2.3?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.17-6.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.aarch64"
},
"product_reference": "haproxy-0:2.4.17-6.el9_2.3.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.17-6.el9_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.ppc64le"
},
"product_reference": "haproxy-0:2.4.17-6.el9_2.3.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.17-6.el9_2.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.s390x"
},
"product_reference": "haproxy-0:2.4.17-6.el9_2.3.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.17-6.el9_2.3.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.src"
},
"product_reference": "haproxy-0:2.4.17-6.el9_2.3.src",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:2.4.17-6.el9_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.x86_64"
},
"product_reference": "haproxy-0:2.4.17-6.el9_2.3.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.aarch64"
},
"product_reference": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.ppc64le"
},
"product_reference": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.s390x"
},
"product_reference": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.x86_64"
},
"product_reference": "haproxy-debuginfo-0:2.4.17-6.el9_2.3.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.17-6.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.aarch64"
},
"product_reference": "haproxy-debugsource-0:2.4.17-6.el9_2.3.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.17-6.el9_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.ppc64le"
},
"product_reference": "haproxy-debugsource-0:2.4.17-6.el9_2.3.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.17-6.el9_2.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.s390x"
},
"product_reference": "haproxy-debugsource-0:2.4.17-6.el9_2.3.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:2.4.17-6.el9_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.x86_64"
},
"product_reference": "haproxy-debugsource-0:2.4.17-6.el9_2.3.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11230",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-11-06T03:09:28.529000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2413003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in haproxy. A stemming from an inefficient algorithmic complexity issue within its bundled mjson parsing library. This vulnerability is triggered when haproxy is configured to analyze JSON content, such as with the json_query or jwt_payload_query function",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "haproxy: denial of service vulnerability in HAProxy mjson library",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.aarch64",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.ppc64le",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.s390x",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.src",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.x86_64",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.aarch64",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.ppc64le",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.s390x",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.x86_64",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.aarch64",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.ppc64le",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.s390x",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-11230"
},
{
"category": "external",
"summary": "RHBZ#2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-11230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230"
}
],
"release_date": "2025-10-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-01T09:38:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.aarch64",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.ppc64le",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.s390x",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.src",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.x86_64",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.aarch64",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.ppc64le",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.s390x",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.x86_64",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.aarch64",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.ppc64le",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.s390x",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22398"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.aarch64",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.ppc64le",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.s390x",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.src",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.x86_64",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.aarch64",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.ppc64le",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.s390x",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.x86_64",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.aarch64",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.ppc64le",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.s390x",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.aarch64",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.ppc64le",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.s390x",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.src",
"AppStream-9.2.0.Z.E4S:haproxy-0:2.4.17-6.el9_2.3.x86_64",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.aarch64",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.ppc64le",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.s390x",
"AppStream-9.2.0.Z.E4S:haproxy-debuginfo-0:2.4.17-6.el9_2.3.x86_64",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.aarch64",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.ppc64le",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.s390x",
"AppStream-9.2.0.Z.E4S:haproxy-debugsource-0:2.4.17-6.el9_2.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "haproxy: denial of service vulnerability in HAProxy mjson library"
}
]
}
RHSA-2025:22548
Vulnerability from csaf_redhat - Published: 2025-12-02 02:21 - Updated: 2025-12-03 15:35Summary
Red Hat Security Advisory: Red Hat Ceph Storage
Notes
Topic
A new version of Red Hat build of Ceph Storage has been released
Details
The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 8.1.
This release updates to the latest version.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new version of Red Hat build of Ceph Storage has been released",
"title": "Topic"
},
{
"category": "general",
"text": "The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 8.1.\nThis release updates to the latest version.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:22548",
"url": "https://access.redhat.com/errata/RHSA-2025:22548"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2024-56433",
"url": "https://access.redhat.com/security/cve/cve-2024-56433"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2025-9230",
"url": "https://access.redhat.com/security/cve/cve-2025-9230"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2025-6965",
"url": "https://access.redhat.com/security/cve/cve-2025-6965"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2025-11561",
"url": "https://access.redhat.com/security/cve/cve-2025-11561"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-11230",
"url": "https://access.redhat.com/security/cve/CVE-2025-11230"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_ceph_storage/",
"url": "https://docs.redhat.com/en/documentation/red_hat_ceph_storage/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22548.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Ceph Storage",
"tracking": {
"current_release_date": "2025-12-03T15:35:35+00:00",
"generator": {
"date": "2025-12-03T15:35:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.13"
}
},
"id": "RHSA-2025:22548",
"initial_release_date": "2025-12-02T02:21:05+00:00",
"revision_history": [
{
"date": "2025-12-02T02:21:05+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-02T04:22:52+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-03T15:35:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ceph Storage 8",
"product": {
"name": "Red Hat Ceph Storage 8",
"product_id": "Red Hat Ceph Storage 8",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ceph_storage:8::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ceph Storage"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x",
"product": {
"name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x",
"product_id": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-haproxy-rhel9@sha256%3Aeef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34?arch=s390x\u0026repository_url=registry.redhat.io/rhceph"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"product": {
"name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"product_id": "registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"product_identification_helper": {
"purl": "pkg:oci/grafana-rhel9@sha256%3A97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8?arch=s390x\u0026repository_url=registry.redhat.io/rhceph"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x",
"product": {
"name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x",
"product_id": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-8-rhel9@sha256%3A75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9?arch=s390x\u0026repository_url=registry.redhat.io/rhceph"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"product": {
"name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"product_id": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-haproxy-rhel9@sha256%3A75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"product": {
"name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"product_id": "registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/grafana-rhel9@sha256%3Ab5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"product": {
"name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"product_id": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-8-rhel9@sha256%3A08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"product": {
"name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"product_id": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-8-rhel9@sha256%3A04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8?arch=amd64\u0026repository_url=registry.redhat.io/rhceph"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"product": {
"name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"product_id": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-haproxy-rhel9@sha256%3A2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6?arch=amd64\u0026repository_url=registry.redhat.io/rhceph"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"product": {
"name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"product_id": "registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"product_identification_helper": {
"purl": "pkg:oci/grafana-rhel9@sha256%3A9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61?arch=amd64\u0026repository_url=registry.redhat.io/rhceph"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"product": {
"name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"product_id": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-haproxy-rhel9@sha256%3Aaea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3?arch=arm64\u0026repository_url=registry.redhat.io/rhceph"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"product": {
"name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"product_id": "registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"product_identification_helper": {
"purl": "pkg:oci/grafana-rhel9@sha256%3A1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3?arch=arm64\u0026repository_url=registry.redhat.io/rhceph"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"product": {
"name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"product_id": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-8-rhel9@sha256%3A69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1?arch=arm64\u0026repository_url=registry.redhat.io/rhceph"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64 as a component of Red Hat Ceph Storage 8",
"product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64"
},
"product_reference": "registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"relates_to_product_reference": "Red Hat Ceph Storage 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x as a component of Red Hat Ceph Storage 8",
"product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x"
},
"product_reference": "registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"relates_to_product_reference": "Red Hat Ceph Storage 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64 as a component of Red Hat Ceph Storage 8",
"product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64"
},
"product_reference": "registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"relates_to_product_reference": "Red Hat Ceph Storage 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le as a component of Red Hat Ceph Storage 8",
"product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le"
},
"product_reference": "registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"relates_to_product_reference": "Red Hat Ceph Storage 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64 as a component of Red Hat Ceph Storage 8",
"product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64"
},
"product_reference": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"relates_to_product_reference": "Red Hat Ceph Storage 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le as a component of Red Hat Ceph Storage 8",
"product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le"
},
"product_reference": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"relates_to_product_reference": "Red Hat Ceph Storage 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64 as a component of Red Hat Ceph Storage 8",
"product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64"
},
"product_reference": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"relates_to_product_reference": "Red Hat Ceph Storage 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x as a component of Red Hat Ceph Storage 8",
"product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x"
},
"product_reference": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x",
"relates_to_product_reference": "Red Hat Ceph Storage 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64 as a component of Red Hat Ceph Storage 8",
"product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64"
},
"product_reference": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"relates_to_product_reference": "Red Hat Ceph Storage 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le as a component of Red Hat Ceph Storage 8",
"product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le"
},
"product_reference": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"relates_to_product_reference": "Red Hat Ceph Storage 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64 as a component of Red Hat Ceph Storage 8",
"product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64"
},
"product_reference": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"relates_to_product_reference": "Red Hat Ceph Storage 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x as a component of Red Hat Ceph Storage 8",
"product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
},
"product_reference": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x",
"relates_to_product_reference": "Red Hat Ceph Storage 8"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-56433",
"cwe": {
"id": "CWE-1188",
"name": "Initialization of a Resource with an Insecure Default"
},
"discovery_date": "2024-12-26T09:00:54.065197+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2334165"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in shadow-utils. Affected versions of shadow-utils establish a default /etc/subuid behavior, for example, uid 100000 through 165535 for the first user account, that can conflict with the uids of users defined on locally administered networks. This issue potentially leads to account takeover by leveraging newuidmap for access to an NFS home directory or same-host resources for remote logins by these local network users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x"
],
"known_not_affected": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-56433"
},
{
"category": "external",
"summary": "RHBZ#2334165",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334165"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-56433",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56433"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56433",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56433"
},
{
"category": "external",
"summary": "https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241",
"url": "https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241"
},
{
"category": "external",
"summary": "https://github.com/shadow-maint/shadow/issues/1157",
"url": "https://github.com/shadow-maint/shadow/issues/1157"
},
{
"category": "external",
"summary": "https://github.com/shadow-maint/shadow/releases/tag/4.4",
"url": "https://github.com/shadow-maint/shadow/releases/tag/4.4"
}
],
"release_date": "2024-12-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-02T02:21:05+00:00",
"details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22548"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise"
},
{
"cve": "CVE-2025-6965",
"cwe": {
"id": "CWE-197",
"name": "Numeric Truncation Error"
},
"discovery_date": "2025-07-15T14:02:19.241458+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2380149"
}
],
"notes": [
{
"category": "description",
"text": "A memory corruption flaw was found in SQLite. Under specific conditions a query can be generated where the number of aggregate terms could exceed the number of columns available. This issue could lead to memory corruption and subsequent unintended behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: Integer Truncation in SQLite",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in SQLite is categorized as Important rather than Critical because, although it involves memory corruption, the conditions required to trigger it are relatively constrained. The flaw arises when a query causes the number of aggregate terms to exceed internal limits, leading to potential buffer overflows or memory mismanagement. However, exploitation requires the ability to craft complex SQL queries and interact with the SQLite engine in a specific manner\u2014typically through direct SQL input. There is no known evidence of arbitrary code execution, privilege escalation, or remote exploitability as a direct result of this flaw. Additionally, most SQLite deployments are embedded in applications where input is tightly controlled or sanitized.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x"
],
"known_not_affected": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-6965"
},
{
"category": "external",
"summary": "RHBZ#2380149",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380149"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-6965",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6965"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6965",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6965"
},
{
"category": "external",
"summary": "https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8",
"url": "https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8"
}
],
"release_date": "2025-07-15T13:44:00.784000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-02T02:21:05+00:00",
"details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22548"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: Integer Truncation in SQLite"
},
{
"cve": "CVE-2025-9230",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2025-09-17T12:15:34.387000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2396054"
}
],
"notes": [
{
"category": "description",
"text": "Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The vulnerability was rated as Moderate because, while the potential impact includes an application level denial of service and possible arbitrary code execution, successful exploitation is considered unlikely due to the high attack complexity and the fact that password-based CMS encryption (PWRI) is rarely used in real-world deployments.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successful exploitation of a CWE-787: Out-of-bounds Write or a CWE-125: Out-of-bounds Read vulnerability, and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe platform enforces hardening guidelines and baseline configurations to ensure secure system and software settings, while least functionality reduces the attack surface by disabling unnecessary services and ports. Rigorous development practices, including static analysis, input validation, and error handling, detect and mitigate memory vulnerabilities before deployment. Process isolation and memory protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) preserve memory integrity by confining faults to individual workloads and preventing unauthorized access. Malicious code protections and continuous system monitoring detect anomalous memory activity and exploitation attempts, reducing the likelihood and impact of out-of-bounds read and write vulnerabilities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x"
],
"known_not_affected": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-9230"
},
{
"category": "external",
"summary": "RHBZ#2396054",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396054"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-9230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230"
}
],
"release_date": "2025-09-30T23:59:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-02T02:21:05+00:00",
"details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22548"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap"
},
{
"cve": "CVE-2025-11230",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-11-06T03:09:28.529000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2413003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in haproxy. A stemming from an inefficient algorithmic complexity issue within its bundled mjson parsing library. This vulnerability is triggered when haproxy is configured to analyze JSON content, such as with the json_query or jwt_payload_query function",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "haproxy: denial of service vulnerability in HAProxy mjson library",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
],
"known_not_affected": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-11230"
},
{
"category": "external",
"summary": "RHBZ#2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-11230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230"
}
],
"release_date": "2025-10-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-02T02:21:05+00:00",
"details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22548"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "haproxy: denial of service vulnerability in HAProxy mjson library"
},
{
"acknowledgments": [
{
"names": [
"Zavier Lee"
]
}
],
"cve": "CVE-2025-11561",
"cwe": {
"id": "CWE-269",
"name": "Improper Privilege Management"
},
"discovery_date": "2025-10-09T12:57:29.851000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2402727"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed this issue as High severity for domain-joined Linux systems using default SSSD configurations. While the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled by default, fallback to the an2ln plugin can occur, allowing a domain user who can modify certain Active Directory attributes (such as userPrincipalName or samAccountName) to map to privileged local accounts. This could lead to unauthorized access or elevated privileges on affected Linux hosts. Administrators are advised to review and apply recommended hardening configurations to mitigate this behavior.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x"
],
"known_not_affected": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-11561"
},
{
"category": "external",
"summary": "RHBZ#2402727",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402727"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-11561",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11561"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11561",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11561"
},
{
"category": "external",
"summary": "https://blog.async.sg/kerberos-ldr",
"url": "https://blog.async.sg/kerberos-ldr"
}
],
"release_date": "2025-10-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-02T02:21:05+00:00",
"details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22548"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure the SSSD Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is configured and the an2ln plugin is disabled by adding \"disable = an2ln\" in a krb5 include file, for example /var/lib/sss/pubconf/krb5.include.d/localauth_plugin and make sure it is included in the Kerberos configuration. Apply vendor updates and follow Red Hat guidance for SSSD hardening.",
"product_ids": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:1d1953d6ed948441a2d441b5050b6bc4f3b8ac66e1724bb0eb2fae2cb56267d3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:97950d588d5b033ab672114c0f5cd96ebd39246795511e7fe2fd1277aa94a1c8_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:9ddb4ab1d3b584f33d6ae2756b13f74e50b5a55630b3000df963595b36ef1b61_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/grafana-rhel9@sha256:b5f1c693c7a01a39ac46a2a35d61f786d3f79deb62fe55e7fdac1ba627fb6dc9_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:04a48d31f7336e0d5958eed1ddb1a117148f791baccef4e6e08943181e6794c8_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:08f8552a0a56a47ab606bed47b603e3d2aedaa389d4a5df4dbfa06acee85c0c0_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:69c4edadc3bfd45dd982764b7f9d9a0f3a6d74d26a0443796aaa4a65455c62d1_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:75e6643866fa05fce50284a164d48533259c91be3fcac85556844a67e25887e9_s390x",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fbfd8ab9adf2a0ee77b5ef5c07be5787a6820ef40b5eef3a27628d94bf188a6_amd64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:75d9ee1d25f4770172b0243aab13a13895f1be84fa0695efdad4a33428594843_ppc64le",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:aea85ef95ff6a40839955c80a64dad0c4ff8bcfd1f4b0b15262caee21ee26ef3_arm64",
"Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:eef8a3d296b098659dfdfb64a9e89b9f955015e29d69976eb3f9feffc9304a34_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems"
}
]
}
RHSA-2025:21691
Vulnerability from csaf_redhat - Published: 2025-11-18 13:44 - Updated: 2025-12-02 06:46Summary
Red Hat Security Advisory: haproxy security update
Notes
Topic
An update for haproxy is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.
Security Fix(es):
* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for haproxy is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:21691",
"url": "https://access.redhat.com/errata/RHSA-2025:21691"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21691.json"
}
],
"title": "Red Hat Security Advisory: haproxy security update",
"tracking": {
"current_release_date": "2025-12-02T06:46:17+00:00",
"generator": {
"date": "2025-12-02T06:46:17+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.13"
}
},
"id": "RHSA-2025:21691",
"initial_release_date": "2025-11-18T13:44:12+00:00",
"revision_history": [
{
"date": "2025-11-18T13:44:12+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-11-18T13:44:12+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-02T06:46:17+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:3.0.5-4.el10_1.1.src",
"product": {
"name": "haproxy-0:3.0.5-4.el10_1.1.src",
"product_id": "haproxy-0:3.0.5-4.el10_1.1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@3.0.5-4.el10_1.1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:3.0.5-4.el10_1.1.aarch64",
"product": {
"name": "haproxy-0:3.0.5-4.el10_1.1.aarch64",
"product_id": "haproxy-0:3.0.5-4.el10_1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@3.0.5-4.el10_1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:3.0.5-4.el10_1.1.aarch64",
"product": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_1.1.aarch64",
"product_id": "haproxy-debugsource-0:3.0.5-4.el10_1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@3.0.5-4.el10_1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.aarch64",
"product": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.aarch64",
"product_id": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@3.0.5-4.el10_1.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:3.0.5-4.el10_1.1.ppc64le",
"product": {
"name": "haproxy-0:3.0.5-4.el10_1.1.ppc64le",
"product_id": "haproxy-0:3.0.5-4.el10_1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@3.0.5-4.el10_1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:3.0.5-4.el10_1.1.ppc64le",
"product": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_1.1.ppc64le",
"product_id": "haproxy-debugsource-0:3.0.5-4.el10_1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@3.0.5-4.el10_1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.ppc64le",
"product": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.ppc64le",
"product_id": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@3.0.5-4.el10_1.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:3.0.5-4.el10_1.1.x86_64",
"product": {
"name": "haproxy-0:3.0.5-4.el10_1.1.x86_64",
"product_id": "haproxy-0:3.0.5-4.el10_1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@3.0.5-4.el10_1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:3.0.5-4.el10_1.1.x86_64",
"product": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_1.1.x86_64",
"product_id": "haproxy-debugsource-0:3.0.5-4.el10_1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@3.0.5-4.el10_1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.x86_64",
"product": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.x86_64",
"product_id": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@3.0.5-4.el10_1.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-0:3.0.5-4.el10_1.1.s390x",
"product": {
"name": "haproxy-0:3.0.5-4.el10_1.1.s390x",
"product_id": "haproxy-0:3.0.5-4.el10_1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy@3.0.5-4.el10_1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debugsource-0:3.0.5-4.el10_1.1.s390x",
"product": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_1.1.s390x",
"product_id": "haproxy-debugsource-0:3.0.5-4.el10_1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debugsource@3.0.5-4.el10_1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.s390x",
"product": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.s390x",
"product_id": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/haproxy-debuginfo@3.0.5-4.el10_1.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:3.0.5-4.el10_1.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.aarch64"
},
"product_reference": "haproxy-0:3.0.5-4.el10_1.1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:3.0.5-4.el10_1.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.ppc64le"
},
"product_reference": "haproxy-0:3.0.5-4.el10_1.1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:3.0.5-4.el10_1.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.s390x"
},
"product_reference": "haproxy-0:3.0.5-4.el10_1.1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:3.0.5-4.el10_1.1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.src"
},
"product_reference": "haproxy-0:3.0.5-4.el10_1.1.src",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-0:3.0.5-4.el10_1.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.x86_64"
},
"product_reference": "haproxy-0:3.0.5-4.el10_1.1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.aarch64"
},
"product_reference": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.ppc64le"
},
"product_reference": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.s390x"
},
"product_reference": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.x86_64"
},
"product_reference": "haproxy-debuginfo-0:3.0.5-4.el10_1.1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_1.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.aarch64"
},
"product_reference": "haproxy-debugsource-0:3.0.5-4.el10_1.1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_1.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.ppc64le"
},
"product_reference": "haproxy-debugsource-0:3.0.5-4.el10_1.1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_1.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.s390x"
},
"product_reference": "haproxy-debugsource-0:3.0.5-4.el10_1.1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-debugsource-0:3.0.5-4.el10_1.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.x86_64"
},
"product_reference": "haproxy-debugsource-0:3.0.5-4.el10_1.1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11230",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-11-06T03:09:28.529000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2413003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in haproxy. A stemming from an inefficient algorithmic complexity issue within its bundled mjson parsing library. This vulnerability is triggered when haproxy is configured to analyze JSON content, such as with the json_query or jwt_payload_query function",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "haproxy: denial of service vulnerability in HAProxy mjson library",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.aarch64",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.ppc64le",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.s390x",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.src",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.x86_64",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.aarch64",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.ppc64le",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.s390x",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.x86_64",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.aarch64",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.ppc64le",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.s390x",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-11230"
},
{
"category": "external",
"summary": "RHBZ#2413003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-11230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230"
}
],
"release_date": "2025-10-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-18T13:44:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.aarch64",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.ppc64le",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.s390x",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.src",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.x86_64",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.aarch64",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.ppc64le",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.s390x",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.x86_64",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.aarch64",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.ppc64le",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.s390x",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:21691"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.aarch64",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.ppc64le",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.s390x",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.src",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.x86_64",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.aarch64",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.ppc64le",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.s390x",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.x86_64",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.aarch64",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.ppc64le",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.s390x",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.aarch64",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.ppc64le",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.s390x",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.src",
"AppStream-10.1.Z:haproxy-0:3.0.5-4.el10_1.1.x86_64",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.aarch64",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.ppc64le",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.s390x",
"AppStream-10.1.Z:haproxy-debuginfo-0:3.0.5-4.el10_1.1.x86_64",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.aarch64",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.ppc64le",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.s390x",
"AppStream-10.1.Z:haproxy-debugsource-0:3.0.5-4.el10_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "haproxy: denial of service vulnerability in HAProxy mjson library"
}
]
}
GHSA-FC36-5GC3-JMHX
Vulnerability from github – Published: 2025-11-19 12:30 – Updated: 2025-11-19 12:30
VLAI?
Details
Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.
Severity ?
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-11230"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-19T10:15:45Z",
"severity": "HIGH"
},
"details": "Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.",
"id": "GHSA-fc36-5gc3-jmhx",
"modified": "2025-11-19T12:30:20Z",
"published": "2025-11-19T12:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230"
},
{
"type": "WEB",
"url": "https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
WID-SEC-W-2025-2209
Vulnerability from csaf_certbund - Published: 2025-10-05 22:00 - Updated: 2025-12-01 23:00Summary
HAProxy und HAProxy ALOHA: Schwachstelle ermöglicht Denial of Service
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
HAProxy ist ein weit verbreiteter Open Source Software Load Balancer und Application Delivery Controller.
HAProxy ALOHA ist ein Plug-and-Play-Hardware- oder virtueller Load Balancer, der auf HAProxy Enterprise basiert und Proxying auf Layer 4 und Layer 7 unterstützt.
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HAProxy und HAProxy ALOHA ausnutzen, um einen Denial of Service Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
- UNIX
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "HAProxy ist ein weit verbreiteter Open Source Software Load Balancer und Application Delivery Controller.\r\nHAProxy ALOHA ist ein Plug-and-Play-Hardware- oder virtueller Load Balancer, der auf HAProxy Enterprise basiert und Proxying auf Layer 4 und Layer 7 unterst\u00fctzt.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HAProxy und HAProxy ALOHA ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-2209 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2209.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-2209 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2209"
},
{
"category": "external",
"summary": "HAProxy Security Update vom 2025-10-05",
"url": "https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7805-1 vom 2025-10-06",
"url": "https://ubuntu.com/security/notices/USN-7805-1"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:03589-1 vom 2025-10-13",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/B5BKK43UYFJDHUUFIWRBM3WCERQINM7G/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:03587-1 vom 2025-10-13",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YPXHU5EXDHILISOEFDEKTXMOINCR5ZWN/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:20872-1 vom 2025-10-27",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/023058.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:20900-1 vom 2025-10-30",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/023114.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:21692 vom 2025-11-18",
"url": "https://access.redhat.com/errata/RHSA-2025:21692"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:21691 vom 2025-11-18",
"url": "https://access.redhat.com/errata/RHSA-2025:21691"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:21694 vom 2025-11-18",
"url": "https://access.redhat.com/errata/RHSA-2025:21694"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:21693 vom 2025-11-18",
"url": "https://access.redhat.com/errata/RHSA-2025:21693"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2025:21691 vom 2025-11-25",
"url": "https://errata.build.resf.org/RLSA-2025:21691"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-21693 vom 2025-11-26",
"url": "https://linux.oracle.com/errata/ELSA-2025-21693.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:22399 vom 2025-12-01",
"url": "https://access.redhat.com/errata/RHSA-2025:22399"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:22398 vom 2025-12-01",
"url": "https://access.redhat.com/errata/RHSA-2025:22398"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:22548 vom 2025-12-02",
"url": "https://access.redhat.com/errata/RHSA-2025:22548"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:22422 vom 2025-12-01",
"url": "https://access.redhat.com/errata/RHSA-2025:22422"
}
],
"source_lang": "en-US",
"title": "HAProxy und HAProxy ALOHA: Schwachstelle erm\u00f6glicht Denial of Service",
"tracking": {
"current_release_date": "2025-12-01T23:00:00.000+00:00",
"generator": {
"date": "2025-12-02T07:58:26.057+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.5.0"
}
},
"id": "WID-SEC-W-2025-2209",
"initial_release_date": "2025-10-05T22:00:00.000+00:00",
"revision_history": [
{
"date": "2025-10-05T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2025-10-06T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2025-10-12T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-10-27T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-10-30T23:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-11-18T23:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2025-11-19T23:00:00.000+00:00",
"number": "7",
"summary": "Referenz(en) aufgenommen: EUVD-2025-198149"
},
{
"date": "2025-11-24T23:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
},
{
"date": "2025-11-25T23:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von Oracle Linux aufgenommen"
},
{
"date": "2025-11-30T23:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2025-12-01T23:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von Red Hat aufgenommen"
}
],
"status": "final",
"version": "11"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "Enterprise \u003c17.0.7",
"product": {
"name": "HAProxy ALOHA Enterprise \u003c17.0.7",
"product_id": "T047409"
}
},
{
"category": "product_version",
"name": "Enterprise 17.0.7",
"product": {
"name": "HAProxy ALOHA Enterprise 17.0.7",
"product_id": "T047409-fixed",
"product_identification_helper": {
"cpe": "cpe:/h:haproxy:aloha:enterprise__17.0.7"
}
}
},
{
"category": "product_version_range",
"name": "Enterprise \u003c16.5.19",
"product": {
"name": "HAProxy ALOHA Enterprise \u003c16.5.19",
"product_id": "T047410"
}
},
{
"category": "product_version",
"name": "Enterprise 16.5.19",
"product": {
"name": "HAProxy ALOHA Enterprise 16.5.19",
"product_id": "T047410-fixed",
"product_identification_helper": {
"cpe": "cpe:/h:haproxy:aloha:enterprise__16.5.19"
}
}
},
{
"category": "product_version_range",
"name": "Enterprise \u003c15.5.28",
"product": {
"name": "HAProxy ALOHA Enterprise \u003c15.5.28",
"product_id": "T047411"
}
},
{
"category": "product_version",
"name": "Enterprise 15.5.28",
"product": {
"name": "HAProxy ALOHA Enterprise 15.5.28",
"product_id": "T047411-fixed",
"product_identification_helper": {
"cpe": "cpe:/h:haproxy:aloha:enterprise__15.5.28"
}
}
},
{
"category": "product_version_range",
"name": "Enterprise \u003c14.5.33",
"product": {
"name": "HAProxy ALOHA Enterprise \u003c14.5.33",
"product_id": "T047412"
}
},
{
"category": "product_version",
"name": "Enterprise 14.5.33",
"product": {
"name": "HAProxy ALOHA Enterprise 14.5.33",
"product_id": "T047412-fixed",
"product_identification_helper": {
"cpe": "cpe:/h:haproxy:aloha:enterprise__14.5.33"
}
}
}
],
"category": "product_name",
"name": "ALOHA"
},
{
"branches": [
{
"category": "product_version_range",
"name": "Community Edition \u003c2.4.30",
"product": {
"name": "HAProxy HAProxy Community Edition \u003c2.4.30",
"product_id": "T047398"
}
},
{
"category": "product_version",
"name": "Community Edition 2.4.30",
"product": {
"name": "HAProxy HAProxy Community Edition 2.4.30",
"product_id": "T047398-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:haproxy:haproxy:community_edition__2.4.30"
}
}
},
{
"category": "product_version_range",
"name": "Community Edition \u003c2.6.23",
"product": {
"name": "HAProxy HAProxy Community Edition \u003c2.6.23",
"product_id": "T047399"
}
},
{
"category": "product_version",
"name": "Community Edition 2.6.23",
"product": {
"name": "HAProxy HAProxy Community Edition 2.6.23",
"product_id": "T047399-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:haproxy:haproxy:community_edition__2.6.23"
}
}
},
{
"category": "product_version_range",
"name": "Community Edition \u003c2.8.16",
"product": {
"name": "HAProxy HAProxy Community Edition \u003c2.8.16",
"product_id": "T047400"
}
},
{
"category": "product_version",
"name": "Community Edition 2.8.16",
"product": {
"name": "HAProxy HAProxy Community Edition 2.8.16",
"product_id": "T047400-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:haproxy:haproxy:community_edition__2.8.16"
}
}
},
{
"category": "product_version_range",
"name": "Community Edition \u003c3.0.12",
"product": {
"name": "HAProxy HAProxy Community Edition \u003c3.0.12",
"product_id": "T047401"
}
},
{
"category": "product_version",
"name": "Community Edition 3.0.12",
"product": {
"name": "HAProxy HAProxy Community Edition 3.0.12",
"product_id": "T047401-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:haproxy:haproxy:community_edition__3.0.12"
}
}
},
{
"category": "product_version_range",
"name": "Community Edition \u003c3.1.9",
"product": {
"name": "HAProxy HAProxy Community Edition \u003c3.1.9",
"product_id": "T047402"
}
},
{
"category": "product_version",
"name": "Community Edition 3.1.9",
"product": {
"name": "HAProxy HAProxy Community Edition 3.1.9",
"product_id": "T047402-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:haproxy:haproxy:community_edition__3.1.9"
}
}
},
{
"category": "product_version_range",
"name": "Community Edition \u003c3.2.6",
"product": {
"name": "HAProxy HAProxy Community Edition \u003c3.2.6",
"product_id": "T047403"
}
},
{
"category": "product_version",
"name": "Community Edition 3.2.6",
"product": {
"name": "HAProxy HAProxy Community Edition 3.2.6",
"product_id": "T047403-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:haproxy:haproxy:community_edition__3.2.6"
}
}
},
{
"category": "product_version_range",
"name": "Enterprise \u003chapee-2.4r1-lb-1.0.0-294.1446",
"product": {
"name": "HAProxy HAProxy Enterprise \u003chapee-2.4r1-lb-1.0.0-294.1446",
"product_id": "T047404"
}
},
{
"category": "product_version",
"name": "Enterprise hapee-2.4r1-lb-1.0.0-294.1446",
"product": {
"name": "HAProxy HAProxy Enterprise hapee-2.4r1-lb-1.0.0-294.1446",
"product_id": "T047404-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:haproxy:haproxy:enterprise__hapee-2.4r1-lb-1.0.0-294.1446"
}
}
},
{
"category": "product_version_range",
"name": "Enterprise \u003chapee-2.6r1-lb-1.0.0-301.1704",
"product": {
"name": "HAProxy HAProxy Enterprise \u003chapee-2.6r1-lb-1.0.0-301.1704",
"product_id": "T047405"
}
},
{
"category": "product_version",
"name": "Enterprise hapee-2.6r1-lb-1.0.0-301.1704",
"product": {
"name": "HAProxy HAProxy Enterprise hapee-2.6r1-lb-1.0.0-301.1704",
"product_id": "T047405-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:haproxy:haproxy:enterprise__hapee-2.6r1-lb-1.0.0-301.1704"
}
}
},
{
"category": "product_version_range",
"name": "Enterprise \u003chapee-2.8r1-lb-1.0.0-327.1146",
"product": {
"name": "HAProxy HAProxy Enterprise \u003chapee-2.8r1-lb-1.0.0-327.1146",
"product_id": "T047406"
}
},
{
"category": "product_version",
"name": "Enterprise hapee-2.8r1-lb-1.0.0-327.1146",
"product": {
"name": "HAProxy HAProxy Enterprise hapee-2.8r1-lb-1.0.0-327.1146",
"product_id": "T047406-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:haproxy:haproxy:enterprise__hapee-2.8r1-lb-1.0.0-327.1146"
}
}
},
{
"category": "product_version_range",
"name": "Enterprise \u003chapee-3.0r1-lb-1.0.0-346.795",
"product": {
"name": "HAProxy HAProxy Enterprise \u003chapee-3.0r1-lb-1.0.0-346.795",
"product_id": "T047407"
}
},
{
"category": "product_version",
"name": "Enterprise hapee-3.0r1-lb-1.0.0-346.795",
"product": {
"name": "HAProxy HAProxy Enterprise hapee-3.0r1-lb-1.0.0-346.795",
"product_id": "T047407-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:haproxy:haproxy:enterprise__hapee-3.0r1-lb-1.0.0-346.795"
}
}
},
{
"category": "product_version_range",
"name": "Enterprise \u003chapee-3.1r1-lb-1.0.0-349.585",
"product": {
"name": "HAProxy HAProxy Enterprise \u003chapee-3.1r1-lb-1.0.0-349.585",
"product_id": "T047408"
}
},
{
"category": "product_version",
"name": "Enterprise hapee-3.1r1-lb-1.0.0-349.585",
"product": {
"name": "HAProxy HAProxy Enterprise hapee-3.1r1-lb-1.0.0-349.585",
"product_id": "T047408-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:haproxy:haproxy:enterprise__hapee-3.1r1-lb-1.0.0-349.585"
}
}
}
],
"category": "product_name",
"name": "HAProxy"
}
],
"category": "vendor",
"name": "HAProxy"
},
{
"branches": [
{
"category": "product_name",
"name": "Oracle Linux",
"product": {
"name": "Oracle Linux",
"product_id": "T004914",
"product_identification_helper": {
"cpe": "cpe:/o:oracle:linux:-"
}
}
}
],
"category": "vendor",
"name": "Oracle"
},
{
"branches": [
{
"category": "product_name",
"name": "RESF Rocky Linux",
"product": {
"name": "RESF Rocky Linux",
"product_id": "T032255",
"product_identification_helper": {
"cpe": "cpe:/o:resf:rocky_linux:-"
}
}
}
],
"category": "vendor",
"name": "RESF"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11230",
"product_status": {
"known_affected": [
"67646",
"T004914",
"T032255",
"T047405",
"T047406",
"T047403",
"T047404",
"T002207",
"T047409",
"T000126",
"T047407",
"T047408",
"T047398",
"T047401",
"T047412",
"T047402",
"T047399",
"T047410",
"T047400",
"T047411"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-11230"
}
]
}
SUSE-SU-2025:03589-1
Vulnerability from csaf_suse - Published: 2025-10-13 07:04 - Updated: 2025-10-13 07:04Summary
Security update for haproxy
Notes
Title of the patch
Security update for haproxy
Description of the patch
This update for haproxy fixes the following issues:
- CVE-2025-11230: Fixed issue in the mjson JSON decoder, that could have let to excessive
resource consumption when processing numbers with large exponents (bsc#1250983).
Patchnames
SUSE-2025-3589,SUSE-SLE-Micro-5.3-2025-3589,SUSE-SLE-Micro-5.4-2025-3589,SUSE-SLE-Micro-5.5-2025-3589,SUSE-SLE-Product-HA-15-SP4-2025-3589,SUSE-SLE-Product-HA-15-SP5-2025-3589
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for haproxy",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for haproxy fixes the following issues:\n\n- CVE-2025-11230: Fixed issue in the mjson JSON decoder, that could have let to excessive\n resource consumption when processing numbers with large exponents (bsc#1250983).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-3589,SUSE-SLE-Micro-5.3-2025-3589,SUSE-SLE-Micro-5.4-2025-3589,SUSE-SLE-Micro-5.5-2025-3589,SUSE-SLE-Product-HA-15-SP4-2025-3589,SUSE-SLE-Product-HA-15-SP5-2025-3589",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_03589-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:03589-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202503589-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:03589-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2025-October/042081.html"
},
{
"category": "self",
"summary": "SUSE Bug 1250983",
"url": "https://bugzilla.suse.com/1250983"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11230 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11230/"
}
],
"title": "Security update for haproxy",
"tracking": {
"current_release_date": "2025-10-13T07:04:38Z",
"generator": {
"date": "2025-10-13T07:04:38Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:03589-1",
"initial_release_date": "2025-10-13T07:04:38Z",
"revision_history": [
{
"date": "2025-10-13T07:04:38Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"product": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"product_id": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.i586",
"product": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.i586",
"product_id": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"product": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"product_id": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"product": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"product_id": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"product": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"product_id": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.3",
"product": {
"name": "SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.4",
"product": {
"name": "SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.5",
"product": {
"name": "SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Availability Extension 15 SP4",
"product": {
"name": "SUSE Linux Enterprise High Availability Extension 15 SP4",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-ha:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Availability Extension 15 SP5",
"product": {
"name": "SUSE Linux Enterprise High Availability Extension 15 SP5",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-ha:15:sp5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64 as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64 as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64 as component of SUSE Linux Enterprise High Availability Extension 15 SP4",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le as component of SUSE Linux Enterprise High Availability Extension 15 SP4",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x as component of SUSE Linux Enterprise High Availability Extension 15 SP4",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64 as component of SUSE Linux Enterprise High Availability Extension 15 SP4",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64 as component of SUSE Linux Enterprise High Availability Extension 15 SP5",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le as component of SUSE Linux Enterprise High Availability Extension 15 SP5",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x as component of SUSE Linux Enterprise High Availability Extension 15 SP5",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64 as component of SUSE Linux Enterprise High Availability Extension 15 SP5",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64"
},
"product_reference": "haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11230",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11230"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.3:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11230",
"url": "https://www.suse.com/security/cve/CVE-2025-11230"
},
{
"category": "external",
"summary": "SUSE Bug 1250983 for CVE-2025-11230",
"url": "https://bugzilla.suse.com/1250983"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.3:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise High Availability Extension 15 SP4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise High Availability Extension 15 SP5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.3:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.4:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.5:haproxy-2.4.22+git0.f8e3218e2-150400.3.25.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-13T07:04:38Z",
"details": "moderate"
}
],
"title": "CVE-2025-11230"
}
]
}
SUSE-SU-2025:03587-1
Vulnerability from csaf_suse - Published: 2025-10-13 07:03 - Updated: 2025-10-13 07:03Summary
Security update for haproxy
Notes
Title of the patch
Security update for haproxy
Description of the patch
This update for haproxy fixes the following issues:
- CVE-2025-11230: Fixed issue in the mjson JSON decoder, that could have let to excessive
resource consumption when processing numbers with large exponents (bsc#1250983).
Patchnames
SUSE-2025-3587,SUSE-SLE-Product-HA-15-SP6-2025-3587,SUSE-SLE-Product-HA-15-SP7-2025-3587,openSUSE-SLE-15.6-2025-3587
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for haproxy",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for haproxy fixes the following issues:\n\n- CVE-2025-11230: Fixed issue in the mjson JSON decoder, that could have let to excessive\n resource consumption when processing numbers with large exponents (bsc#1250983).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-3587,SUSE-SLE-Product-HA-15-SP6-2025-3587,SUSE-SLE-Product-HA-15-SP7-2025-3587,openSUSE-SLE-15.6-2025-3587",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_03587-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:03587-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202503587-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:03587-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2025-October/042082.html"
},
{
"category": "self",
"summary": "SUSE Bug 1250983",
"url": "https://bugzilla.suse.com/1250983"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11230 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11230/"
}
],
"title": "Security update for haproxy",
"tracking": {
"current_release_date": "2025-10-13T07:03:55Z",
"generator": {
"date": "2025-10-13T07:03:55Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:03587-1",
"initial_release_date": "2025-10-13T07:03:55Z",
"revision_history": [
{
"date": "2025-10-13T07:03:55Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"product": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"product_id": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.i586",
"product": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.i586",
"product_id": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"product": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"product_id": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"product": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"product_id": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64",
"product": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64",
"product_id": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Availability Extension 15 SP6",
"product": {
"name": "SUSE Linux Enterprise High Availability Extension 15 SP6",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-ha:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Availability Extension 15 SP7",
"product": {
"name": "SUSE Linux Enterprise High Availability Extension 15 SP7",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-ha:15:sp7"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64 as component of SUSE Linux Enterprise High Availability Extension 15 SP6",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le as component of SUSE Linux Enterprise High Availability Extension 15 SP6",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x as component of SUSE Linux Enterprise High Availability Extension 15 SP6",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64 as component of SUSE Linux Enterprise High Availability Extension 15 SP6",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64 as component of SUSE Linux Enterprise High Availability Extension 15 SP7",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le as component of SUSE Linux Enterprise High Availability Extension 15 SP7",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x as component of SUSE Linux Enterprise High Availability Extension 15 SP7",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64 as component of SUSE Linux Enterprise High Availability Extension 15 SP7",
"product_id": "SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11230",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11230"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64",
"SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64",
"openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11230",
"url": "https://www.suse.com/security/cve/CVE-2025-11230"
},
{
"category": "external",
"summary": "SUSE Bug 1250983 for CVE-2025-11230",
"url": "https://bugzilla.suse.com/1250983"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64",
"SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64",
"openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"SUSE Linux Enterprise High Availability Extension 15 SP6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64",
"SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"SUSE Linux Enterprise High Availability Extension 15 SP7:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64",
"openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.aarch64",
"openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.ppc64le",
"openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.s390x",
"openSUSE Leap 15.6:haproxy-2.8.11+git0.01c1056a4-150600.3.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-13T07:03:55Z",
"details": "moderate"
}
],
"title": "CVE-2025-11230"
}
]
}
SUSE-SU-2025:20872-1
Vulnerability from csaf_suse - Published: 2025-10-23 15:27 - Updated: 2025-10-23 15:27Summary
Security update for haproxy
Notes
Title of the patch
Security update for haproxy
Description of the patch
This update for haproxy fixes the following issues:
- CVE-2025-11230: Fixed mjson JSON decoder excessive resource consumption (bsc#1250983)
Patchnames
SUSE-SLE-Micro-6.0-502
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for haproxy",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for haproxy fixes the following issues:\n\n- CVE-2025-11230: Fixed mjson JSON decoder excessive resource consumption (bsc#1250983)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-502",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20872-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:20872-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520872-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:20872-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/023058.html"
},
{
"category": "self",
"summary": "SUSE Bug 1250983",
"url": "https://bugzilla.suse.com/1250983"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11230 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11230/"
}
],
"title": "Security update for haproxy",
"tracking": {
"current_release_date": "2025-10-23T15:27:42Z",
"generator": {
"date": "2025-10-23T15:27:42Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:20872-1",
"initial_release_date": "2025-10-23T15:27:42Z",
"revision_history": [
{
"date": "2025-10-23T15:27:42Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.8.11+git0.01c1056a4-2.1.aarch64",
"product": {
"name": "haproxy-2.8.11+git0.01c1056a4-2.1.aarch64",
"product_id": "haproxy-2.8.11+git0.01c1056a4-2.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.8.11+git0.01c1056a4-2.1.s390x",
"product": {
"name": "haproxy-2.8.11+git0.01c1056a4-2.1.s390x",
"product_id": "haproxy-2.8.11+git0.01c1056a4-2.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.8.11+git0.01c1056a4-2.1.x86_64",
"product": {
"name": "haproxy-2.8.11+git0.01c1056a4-2.1.x86_64",
"product_id": "haproxy-2.8.11+git0.01c1056a4-2.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-2.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:haproxy-2.8.11+git0.01c1056a4-2.1.aarch64"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-2.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-2.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:haproxy-2.8.11+git0.01c1056a4-2.1.s390x"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-2.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-2.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:haproxy-2.8.11+git0.01c1056a4-2.1.x86_64"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-2.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11230",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11230"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:haproxy-2.8.11+git0.01c1056a4-2.1.aarch64",
"SUSE Linux Micro 6.0:haproxy-2.8.11+git0.01c1056a4-2.1.s390x",
"SUSE Linux Micro 6.0:haproxy-2.8.11+git0.01c1056a4-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11230",
"url": "https://www.suse.com/security/cve/CVE-2025-11230"
},
{
"category": "external",
"summary": "SUSE Bug 1250983 for CVE-2025-11230",
"url": "https://bugzilla.suse.com/1250983"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:haproxy-2.8.11+git0.01c1056a4-2.1.aarch64",
"SUSE Linux Micro 6.0:haproxy-2.8.11+git0.01c1056a4-2.1.s390x",
"SUSE Linux Micro 6.0:haproxy-2.8.11+git0.01c1056a4-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:haproxy-2.8.11+git0.01c1056a4-2.1.aarch64",
"SUSE Linux Micro 6.0:haproxy-2.8.11+git0.01c1056a4-2.1.s390x",
"SUSE Linux Micro 6.0:haproxy-2.8.11+git0.01c1056a4-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-23T15:27:42Z",
"details": "moderate"
}
],
"title": "CVE-2025-11230"
}
]
}
SUSE-SU-2025:20900-1
Vulnerability from csaf_suse - Published: 2025-10-24 12:38 - Updated: 2025-10-24 12:38Summary
Security update for haproxy
Notes
Title of the patch
Security update for haproxy
Description of the patch
This update for haproxy fixes the following issues:
- CVE-2025-11230: Fixed mjson JSON decoder excessive resource consumption (bsc#1250983)
Patchnames
SUSE-SLE-Micro-6.1-320
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for haproxy",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for haproxy fixes the following issues:\n\n- CVE-2025-11230: Fixed mjson JSON decoder excessive resource consumption (bsc#1250983)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.1-320",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20900-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:20900-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520900-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:20900-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/023114.html"
},
{
"category": "self",
"summary": "SUSE Bug 1250983",
"url": "https://bugzilla.suse.com/1250983"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11230 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11230/"
}
],
"title": "Security update for haproxy",
"tracking": {
"current_release_date": "2025-10-24T12:38:16Z",
"generator": {
"date": "2025-10-24T12:38:16Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:20900-1",
"initial_release_date": "2025-10-24T12:38:16Z",
"revision_history": [
{
"date": "2025-10-24T12:38:16Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.aarch64",
"product": {
"name": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.aarch64",
"product_id": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.ppc64le",
"product": {
"name": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.ppc64le",
"product_id": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.s390x",
"product": {
"name": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.s390x",
"product_id": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.x86_64",
"product": {
"name": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.x86_64",
"product_id": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.1",
"product": {
"name": "SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.aarch64"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.ppc64le as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.ppc64le"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.s390x as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.s390x"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.x86_64"
},
"product_reference": "haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11230",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11230"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.aarch64",
"SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.ppc64le",
"SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.s390x",
"SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11230",
"url": "https://www.suse.com/security/cve/CVE-2025-11230"
},
{
"category": "external",
"summary": "SUSE Bug 1250983 for CVE-2025-11230",
"url": "https://bugzilla.suse.com/1250983"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.aarch64",
"SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.ppc64le",
"SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.s390x",
"SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.aarch64",
"SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.ppc64le",
"SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.s390x",
"SUSE Linux Micro 6.1:haproxy-2.8.11+git0.01c1056a4-slfo.1.1_2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-24T12:38:16Z",
"details": "moderate"
}
],
"title": "CVE-2025-11230"
}
]
}
FKIE_CVE-2025-11230
Vulnerability from fkie_nvd - Published: 2025-11-19 10:15 - Updated: 2025-11-19 19:14
Severity ?
Summary
Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests."
}
],
"id": "CVE-2025-11230",
"lastModified": "2025-11-19T19:14:59.327",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "security@ubuntu.com",
"type": "Secondary"
}
]
},
"published": "2025-11-19T10:15:45.020",
"references": [
{
"source": "security@ubuntu.com",
"url": "https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability"
}
],
"sourceIdentifier": "security@ubuntu.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-407"
}
],
"source": "security@ubuntu.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…