CVE-2025-3526: Liferay Portal SessionClicks Memory Consumption Vulnerability
Summary
CVE-2025-3526: Liferay Portal SessionClicks does not restrict the saving of request parameters in the HTTP session. Affects com.liferay.portal:com.liferay.portal.kernel versions < 38.0.0. Fixed in 38.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. It provides a robust framework for developing enterprise-level applications with features like user management, workflow, and content management. However, versions 7.0.0 through 7.4.3.21, as well as Liferay DXP 7.4 GA through update 9 and 7.3 GA through update 25, are vulnerable to a serious issue in the SessionClicks component, which can lead to denial-of-service conditions.
Vulnerability Detail
The vulnerability in SessionClicks arises from the lack of restrictions on saving request parameters in the HTTP session. This oversight allows remote attackers to craft specific HTTP requests that can consume excessive system memory. As a result, this can lead to denial-of-service (DoS) conditions, where legitimate users are unable to access the application due to resource exhaustion. The vulnerability is classified under CWE-400, indicating that it relates to the potential for resource consumption.
How To Fix
Minimum fixed version
38.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on incoming requests to the SessionClicks component. This can help mitigate the impact of potential attacks by limiting the number of requests a user can make in a given timeframe.
Conclusion
The CVE-2025-3526 vulnerability in Liferay Portal's SessionClicks component poses a significant risk of denial-of-service attacks due to unrestricted saving of request parameters. It is crucial for users of affected versions to update to the patched version to mitigate this risk. Additionally, implementing rate limiting can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for com.liferay.portal:com.liferay.portal.kernel →
FAQ
CVE-2025-3526 is a vulnerability in Liferay Portal's SessionClicks component that allows remote attackers to consume system memory, leading to denial-of-service conditions.
The affected versions include Liferay Portal 7.0.0 through 7.4.3.21, Liferay DXP 7.4 GA through update 9, and 7.3 GA through update 25.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability can lead to denial-of-service conditions, making the application unavailable to legitimate users due to resource exhaustion.
Yes, a patch is available. Updating to version 38.0.0 of the com.liferay.portal.kernel package will resolve the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:com.liferay.portal.kernel.
