PT-2025-37343 · Liferay · Liferay Portal+1

Published 2025-09-12 · Updated 2025-12-16 · CVE-2025-43796

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.101 Liferay DXP versions 2023.Q3.0 through 2023.Q3.4 Liferay Portal versions 7.4 GA through update 92 Liferay Portal versions 7.3 GA through update 35

Description: The software does not limit the number of objects returned from GraphQL queries, potentially allowing remote attackers to perform denial-of-service (DoS) attacks by executing queries that return a large number of objects.

Recommendations: Update Liferay Portal to a version later than 7.4.3.101. Update Liferay DXP to a version later than 2023.Q3.4. Update Liferay Portal to a version later than update 92. Update Liferay Portal to a version later than update 35.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-43796

GHSA-F3HF-R62C-MFRJ

Affected Products

Liferay Dxp

Liferay Portal

References · 16

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43796 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43796 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f3hf-r62c-mfrj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43796 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/2e4adf041e31f3474a14c29b7c135693f6529400 · Note
• https://github.com/liferay/liferay-portal/commit/3780804b0d8f4f14bfca470a3e2e662bc6cef588 · Note
• https://github.com/liferay/liferay-portal/commit/8344aec3bebcd2ca409794523d5db5be6047c3dd · Note
• https://github.com/liferay/liferay-portal/commit/83e77963499d4d3e7cc82cc48e63c992f6f29a6d · Note
• https://github.com/liferay/liferay-portal/commit/8dda4adc0e9e7b6f82d4b3959592cad61640309b · Note
• https://github.com/liferay/liferay-portal/commit/2f74f23982fb03238f9b4ae145c33a9c1084f07e · Note
• https://t.me/CVEtracker/32409 · Telegram Post
• https://twitter.com/offseq/status/1967060932850303426 · Twitter Post
• https://t.me/cveNotify/145954 · Telegram Post
• http://github.com/liferay/liferay-portal/commit/8f7eb98e05a5ea6961346ecc21fd73e4b46bba99 · Note