MiracleLinux 9 : haproxy-2.8.14-1.el9_7.1 (AXSA:2025-11521:04)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2025-11521:04 advisory. haproxy: denial of service vulnerability in HAProxy mjson library CVE-2025-11230 Tenable has extracted the preceding description block directly from the...

GHSA-QQ72-VH82-FWV9 vulnerabilities

Vulnerabilities for packages: haproxy...

CVE-2024-53008 vulnerabilities

Vulnerabilities for packages: haproxy...

PT-2026-8282

Name of the Vulnerable Software and Affected Versions HAProxy Community Edition versions 3.2.x through 3.3.2 HAProxy Enterprise affected versions not specified ALOHA affected versions not specified Description An issue exists where the software can enter a loop or crash due to the mishandling of...

PT-2026-7983

Name of the Vulnerable Software and Affected Versions HAProxy affected versions not specified Description HAProxy is susceptible to a denial of service. A remote attacker may be able to cause HAProxy to crash by sending specially crafted INITIAL packets, specifically those using the NEW TOKEN...

CVE-2025-11230 vulnerabilities

Vulnerabilities for packages: haproxy...

GHSA-FC36-5GC3-JMHX vulnerabilities

Vulnerabilities for packages: haproxy...

curl: HAProxy Connection Reuse leads to IP Spoofing and mTLS Context Smuggling

Executive Summary libcurl fails to respect the CURLOPTHAPROXYCLIENTIP configuration when reusing existing connections. Due to a missing check in the connection pooling logic, libcurl indiscriminately reuses a TCP/TLS connection established with a specific identity IP A for subsequent requests...

BIT-HAPROXY-2025-11230 Denial of service vulnerability in HAProxy mjson library

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests...

CVE-2025-11230 affecting package haproxy for versions less than 2.4.24-2

CVE-2025-11230 affecting package haproxy for versions less than 2.4.24-2. A patched version of the package is available...

CVE-2025-11230 affecting package haproxy for versions less than 2.9.11-4

CVE-2025-11230 affecting package haproxy for versions less than 2.9.11-4. A patched version of the package is available...

CLSA-2025-1765545936 haproxy: Fix of CVE-2025-11230

CVE-2025-11230: fix possible DoS in mjson library when parsing numbers...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: kubo-fips, request-1279-14, cloudprober-fips, helm-mapkubeapis, prometheus-pgbouncer-exporter-fips, cert-manager-webhook-pdns, spicedb-operator, nemo, opentelemetry-operator, cloudflared-fips, go-discover-fips, buildkitd-fips, sbom-convert, petname, openfga-fips,...

Oracle Linux 10 : haproxy (ELSA-2025-21691)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-21691 advisory. 3.0.5-4.1 - Fix denial of service vulnerability in mjson library CVE-2025-11230 Resolves: RHEL-126652 Tenable has extracted the preceding description block...

RockyLinux 9 : haproxy (RLSA-2025:21693)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:21693 advisory. haproxy: denial of service vulnerability in HAProxy mjson library CVE-2025-11230 Tenable has extracted the preceding description block directly from the RockyLin...

Linux Distros Unpatched Vulnerability : CVE-2025-59303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update...

RHSA-2025:22422 Red Hat Security Advisory: haproxy security update

Bulletin has no description...

RHSA-2025:22398 Red Hat Security Advisory: haproxy security update

Bulletin has no description...

RHSA-2025:22399 Red Hat Security Advisory: haproxy security update

Bulletin has no description...

Keycloak unable to restrict access to the admin console

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to...