HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected.
A flaw was found in haproxy. A stemming from an inefficient algorithmic complexity issue within its bundled mjson parsing library. This vulnerability is triggered when haproxy is configured to analyze JSON content, such as with the jsonquery or jwtpayloadquery function