CVE-2025-43796 json
Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack
published 2025-09-12 13 mo ago modified 2026-10-18 21 d ago also GHSA-f3hf-r62c-mfrj , EUVD-2025-29072
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing queries that return a large number of objects.
Patch / fix
- maven com.liferay:com.liferay.portal.vulcan.api 40.2.0
- maven com.liferay:com.liferay.portal.vulcan.impl 5.0.105
- liferay digital_experience_platform 2023.Q3.5
- liferay liferay_portal 7.4.3.102
- github.com/liferay/liferay-portal@2e4adf0 commit
- github.com/liferay/liferay-portal@2f74f23 commit
- github.com/liferay/liferay-portal@3780804 commit
- github.com/liferay/liferay-portal@8344aec commit
- github.com/liferay/liferay-portal@83e7796 commit
- github.com/liferay/liferay-portal@8dda4ad commit
- github.com/liferay/liferay-portal@8f7eb98 commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 13 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.portal.vulcan.api | >=8.0.2, <40.2.0 |
40.2.0 |
| maven | com.liferay:com.liferay.portal.vulcan.impl | >=5.0.7, <5.0.105 |
5.0.105 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/liferay/liferay-portal/commit/2e4adf041e31f3474a14c29b7c135693f6529400
web
-
github.com
/liferay/liferay-portal/commit/2f74f23982fb03238f9b4ae145c33a9c1084f07e
web
-
github.com
/liferay/liferay-portal/commit/3780804b0d8f4f14bfca470a3e2e662bc6cef588
web
-
github.com
/liferay/liferay-portal/commit/8344aec3bebcd2ca409794523d5db5be6047c3dd
web
-
github.com
/liferay/liferay-portal/commit/83e77963499d4d3e7cc82cc48e63c992f6f29a6d
web
-
github.com
/liferay/liferay-portal/commit/8dda4adc0e9e7b6f82d4b3959592cad61640309b
web
-
github.com
/liferay/liferay-portal/commit/8f7eb98e05a5ea6961346ecc21fd73e4b46bba99
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43796
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43796
advisory
-
github.com
/liferay/liferay-portal
web
Sources
- CVE List CVE-2025-43796
- GitHub Advisory GHSA-f3hf-r62c-mfrj
- NVD CVE-2025-43796
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.