GitHub Advisoryadvisory · Maven

GHSA-f3hf-r62c-mfrj Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack

HIGH Published 2025-09-12 Modified 2025-09-15 Official page ↗
Aliases
CVE-2025-43796
Ecosystem
Maven
Packages
com.liferay:com.liferay.portal.vulcan.api, com.liferay:com.liferay.portal.vulcan.impl
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-400
Reviewed
2025-09-15

Affected packages

• Maven com.liferay:com.liferay.portal.vulcan.api: >= 8.0.2, < 40.2.0 → fixed in 40.2.0 • Maven com.liferay:com.liferay.portal.vulcan.impl: >= 5.0.7, < 5.0.105 → fixed in 5.0.105

Description

Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing queries that return a large number of objects.

Related

Alias · CVE (1)

  • CVE-2025-43796 Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References