GitHub Advisoryadvisory · Maven

GHSA-vgqx-447m-wvcj Liferay Portal Vulnerable to DoS via Crafted Headless API Request

HIGH Published 2025-10-28 Modified 2025-11-15 Official page ↗
Aliases
CVE-2025-62260
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-400
Reviewed
2025-10-29

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.0-ga1, < 7.4.3.100 → fixed in 7.4.3.100

Description

Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.

Related

Alias · CVE (1)

  • CVE-2025-62260 Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References