CVE-2025-11230 is a vulnerability in haproxy stemming from an inefficient algorithmic complexity issue within its bundled mjson parsing library. When haproxy is configured to analyze JSON content (e.g., using json_query or jwt_payload_query functions), this flaw can be exploited to cause denial of service through excessive CPU, memory, or other resource consumption. Red Hat Product Security has assigned a high severity rating and a CVSS 3.1 base score of 7.5 for their product context. The vulnerability is tracked under Red Hat Advisory RHSA-2026:8729. Currently, no mitigation meeting Red Hat's criteria is available, and a fix has not been released. The advisory notes that mitigation options either do not exist or are not practical for widespread deployment or stability.

The vulnerability can lead to denial of service conditions by consuming excessive CPU, memory, or other system resources when haproxy processes specially crafted JSON content. This impacts availability but does not affect confidentiality or integrity. There are no known exploits in the wild at this time. The issue affects Red Hat Hardened Images RPMs containing haproxy versions prior to the fixed release, though the exact fixed version is not specified in the provided data.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, applicability, or stability. Users are advised to monitor Red Hat advisories for updates and fixes. Upgrading to a fixed version when available is recommended. Customers with Red Hat Technical Account Managers (TAM) can consult directly for guidance. No official patch or workaround is confirmed at this time.