HAProxy Denial-of-Service Vulnerability in mjson Library

A denial-of-service vulnerability has been identified in HAProxy due to an inefficient algorithm in the mjson library, which is used for JSON parsing. This vulnerability allows remote attackers to cause a denial of service by sending specially crafted JSON requests with large values. The issue affects all current versions of HAProxy, including the Community Edition, Enterprise Edition, ALOHA appliances, and the Kubernetes Ingress Controller, whenever JSON parsing functions are used.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, where the HAProxy process is terminated, causing service disruption.

Remediation

Users should upgrade to the latest version of HAProxy. Instructions for upgrading HAProxy Enterprise, ALOHA, and both versions of the Kubernetes Ingress Controller are available in the HAProxy customer documentation.