CVE-2025-62260

CWE-400 — Uncontrolled Resource Consumption4 documents4 sources
Severity
7.1HIGH
EPSS
0.2%
top 62.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Liferay PortalLiferay DXPLiferay Portal+1 more
Timeline
PublishedOct 27
Latest updateOct 28

Description

Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages5 packages

▶NVDliferay/liferay_portal7.4.0 — 7.4.3.99
▶Mavencom.liferay.portal:release.portal.bom7.4.0-ga1 — 7.4.3.100
▶CVEListV5liferay/portal7.4.0 — 7.4.3.99
▶CVEListV5liferay/dxp7.3.10 — 7.3.10-u35+2

🔴Vulnerability Details

3
OSV
Liferay Portal Vulnerable to DoS via Crafted Headless API Request↗2025-10-28
▶
GHSA
Liferay Portal Vulnerable to DoS via Crafted Headless API Request↗2025-10-28
▶
CVEList
CVE-2025-62260: Liferay Portal 7↗2025-10-27
▶
CVE-2025-62260 (HIGH CVSS 7.1) | Liferay Portal 7.4.0 through 7.4.3. | cvebase.io