CVE-2025-43736: Liferay Portal and Liferay DXP Denial Of Service via File Upload Vulnerability
Summary
CVE-2025-43736: Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability. Affects com.liferay.portal:release.portal.bom versions >= 7.4.3.0, <= 7.4.3.132. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal and Liferay DXP are powerful platforms designed for building and managing web applications and digital experiences. They offer a range of features including user management, content management, and customizable workflows. However, they are susceptible to vulnerabilities that can compromise their performance and security. This specific vulnerability allows users to upload profile pictures exceeding the maximum size limit, leading to potential service degradation.
Vulnerability Detail
A Denial Of Service (DOS) vulnerability exists in Liferay Portal versions 7.4.3.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.8, among others. This vulnerability allows users to upload profile pictures larger than the specified maximum size of 300kb. The excessive data can significantly slow down the Liferay service, impacting user experience and system performance. The vulnerability arises from inadequate validation of file upload sizes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement server-side validation to restrict file uploads to a maximum size of 300kb. This can be done by adding a check in your file upload handling code to reject files exceeding this size.
Conclusion
In summary, CVE-2025-43736 is a significant Denial Of Service vulnerability affecting Liferay Portal and Liferay DXP due to improper file upload size validation. Users are encouraged to update their installations to the latest patched versions to mitigate this risk.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2025-43736 is a vulnerability in Liferay Portal and Liferay DXP that allows users to upload files larger than the allowed size, potentially leading to a Denial Of Service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your pom.xml file at Vulert Scanner to check for vulnerabilities without any signup.
The vulnerability can lead to significant slowdowns in the Liferay service, affecting user experience and system performance.
To update your Liferay installation, modify your pom.xml file to include the patched version of the affected packages and then rebuild your application.
Yes, the permanent fix is to update to the latest patched versions of Liferay Portal and Liferay DXP as specified in the 'how to fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
