GitHub Advisoryadvisory · Maven

GHSA-q95h-87j6-273x Liferay Portal ComboServlet denial of service via large file combination

MEDIUM Published 2025-10-24 Modified 2025-11-15 Official page ↗
Aliases
CVE-2025-62254
Ecosystem
Maven
Packages
com.liferay.portal:com.liferay.portal.impl
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-22
Reviewed
2025-10-24

Affected packages

• Maven com.liferay.portal:com.liferay.portal.impl: < 97.0.0 → fixed in 97.0.0

Description

The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number or size of the files it will combine, which allows remote attackers to create very large responses that lead to a denial of service attack via the URL query string.

Related

Alias · CVE (1)

  • CVE-2025-62254 The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2,… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References