| Name | CVE-2025-11230 |
| Description | BUG/CRITICAL: mjson: fix possible DoS when parsing numbers |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-6017-1 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| haproxy (PTS) | bullseye | 2.2.9-2+deb11u6 | fixed |
| bullseye (security) | 2.2.9-2+deb11u7 | fixed |
| bookworm | 2.6.12-1+deb12u2 | vulnerable |
| bookworm (security) | 2.6.12-1+deb12u3 | fixed |
| trixie | 3.0.11-1 | vulnerable |
| trixie (security) | 3.0.11-1+deb13u1 | fixed |
| forky | 3.2.5-1 | vulnerable |
| sid | 3.2.6-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
[bullseye] - haproxy <not-affected> (Vulnerable code introduced later)
Introduced with: https://github.com/haproxy/haproxy/commit/41007a6835fe29f865e01d8fbeb96114c0d01828 (v2.4-dev17)
Fixed by: https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=6fd1287526eae1b31329997a2df29c9fb564a8e8 (v3.2.6)
Fixed by: https://github.com/haproxy/haproxy/commit/06675db4bf234ed17e14305f1d59259d2fe78b06 (v3.3-dev9)