High severityNVD Advisory· Published Jun 16, 2025· Updated Jun 16, 2025

CVE-2025-3602

Description

Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.liferay:com.liferay.portal.vulcan.implMaven	< 5.0.103	5.0.103

Affected products

ghsa-coords
pkg:maven/com.liferay/com.liferay.portal.vulcan.impl
Range: < 5.0.103
Liferay/Portalv5
Range: 7.4.0
Liferay/DXPcpe-rescue
Range: 7.2.10-dxp-8

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-8c26-xm99-53w7ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-3602ghsaADVISORY
github.com/liferay/liferay-portal/commit/6c6dad38c9c891ad58cdee9deb2e35432d7e8816ghsaWEB
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3602ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000