CVE-2025-43736 json
Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability
published 2025-08-12 14 mo ago modified 2026-06-17 4 mo ago also GHSA-cg99-m88x-422c , EUVD-2025-24251
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile picture into the user profile. This size more than the noted max 300kb size. This extra amount of data can make Liferay slower.
Patch / fix
- maven com.liferay.portal:release.dxp.bom 2024.Q1.17, 2025.Q1.9
- maven com.liferay:com.liferay.frontend.taglib 13.10.0
- maven com.liferay:com.liferay.image.uploader.web 5.0.56
- maven com.liferay:com.liferay.users.admin.web 11.0.27
- maven com.liferay:com.liferay.account.admin.web 2.0.138
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:X |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:release.portal.bom | >=7.4.3.0, <=7.4.3.132 |
no fix listed |
| maven | com.liferay.portal:release.dxp.bom | >=2025.Q1.0, <2025.Q1.9 >=2024.Q4.0, <=2024.Q4.7 >=2024.Q3.0, <=2024.Q3.13 >=2024.Q2.0, <=2024.Q2.13 >=2024.Q1.0, <2024.Q1.17 <=7.4.13.u92 |
2025.Q1.9 2024.Q1.17 |
| maven | com.liferay:com.liferay.frontend.taglib | <13.10.0 |
13.10.0 |
| maven | com.liferay:com.liferay.image.uploader.web | <5.0.56 |
5.0.56 |
| maven | com.liferay:com.liferay.users.admin.web | <11.0.27 |
11.0.27 |
| maven | com.liferay:com.liferay.account.admin.web | <2.0.138 |
2.0.138 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/liferay/liferay-portal/commit/ab8932bee29df7df377c468f662d55e624d9390d
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43736
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43736
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-18220
web
Sources
- CVE List CVE-2025-43736
- GitHub Advisory GHSA-cg99-m88x-422c
- NVD CVE-2025-43736
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.