GitHub Advisoryadvisory · Maven

GHSA-cg99-m88x-422c Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

MEDIUM Published 2025-08-12 Modified 2025-08-12 Official page ↗
Aliases
CVE-2025-43736
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.frontend.taglib, com.liferay:com.liferay.image.uploader.web, com.liferay:com.liferay.users.admin.web, com.liferay:com.liferay.account.admin.web
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L
Weaknesses
CWE-770
Reviewed
2025-08-12

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.3.0, <= 7.4.3.132 (no fix yet) • Maven com.liferay.portal:release.dxp.bom: >= 2025.Q1.0, < 2025.Q1.9 → fixed in 2025.Q1.9 • Maven com.liferay.portal:release.dxp.bom: >= 2024.Q4.0, <= 2024.Q4.7 (no fix yet) • Maven com.liferay.portal:release.dxp.bom: >= 2024.Q3.0, <= 2024.Q3.13 (no fix yet) • Maven com.liferay.portal:release.dxp.bom: >= 2024.Q2.0, <= 2024.Q2.13 (no fix yet) • Maven com.liferay.portal:release.dxp.bom: >= 2024.Q1.0, < 2024.Q1.17 → fixed in 2024.Q1.17 • Maven com.liferay.portal:release.dxp.bom: <= 7.4.13.u92 (no fix yet) • Maven com.liferay:com.liferay.frontend.taglib: < 13.10.0 → fixed in 13.10.0 • Maven com.liferay:com.liferay.image.uploader.web: < 5.0.56 → fixed in 5.0.56 • Maven com.liferay:com.liferay.users.admin.web: < 11.0.27 → fixed in 11.0.27 • Maven com.liferay:com.liferay.account.admin.web: < 2.0.138 → fixed in 2.0.138

Description

A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.

Related

Alias · CVE (1)

  • CVE-2025-43736 A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References