High severityNVD Advisory· Published Sep 12, 2025· Updated Sep 12, 2025
CVE-2025-43796
CVE-2025-43796
Description
Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing queries that return a large number of objects.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.liferay:com.liferay.portal.vulcan.apiMaven | >= 8.0.2, < 40.2.0 | 40.2.0 |
com.liferay:com.liferay.portal.vulcan.implMaven | >= 5.0.7, < 5.0.105 | 5.0.105 |
Affected products
4- ghsa-coords2 versionspkg:maven/com.liferay/com.liferay.portal.vulcan.apipkg:maven/com.liferay/com.liferay.portal.vulcan.impl
>= 8.0.2, < 40.2.0+ 1 more
- (no CPE)range: >= 8.0.2, < 40.2.0
- (no CPE)range: >= 5.0.7, < 5.0.105
Patches
Vulnerability mechanics
References
10- github.com/advisories/GHSA-f3hf-r62c-mfrjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-43796ghsaADVISORY
- github.com/liferay/liferay-portal/commit/8f7eb98e05a5ea6961346ecc21fd73e4b46bba99ghsaWEB
- github.com/liferay/liferay-portal/commit/2e4adf041e31f3474a14c29b7c135693f6529400ghsaWEB
- github.com/liferay/liferay-portal/commit/2f74f23982fb03238f9b4ae145c33a9c1084f07eghsaWEB
- github.com/liferay/liferay-portal/commit/3780804b0d8f4f14bfca470a3e2e662bc6cef588ghsaWEB
- github.com/liferay/liferay-portal/commit/8344aec3bebcd2ca409794523d5db5be6047c3ddghsaWEB
- github.com/liferay/liferay-portal/commit/83e77963499d4d3e7cc82cc48e63c992f6f29a6dghsaWEB
- github.com/liferay/liferay-portal/commit/8dda4adc0e9e7b6f82d4b3959592cad61640309bghsaWEB
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43796ghsaWEB
News mentions
0No linked articles in our index yet.