CVE-2025-62254: Liferay Portal ComboServlet Denial of Service via Large File Combination
Summary
CVE-2025-62254: Liferay Portal ComboServlet denial of service via large file combination. Affects com.liferay.portal:com.liferay.portal.impl versions < 97.0.0. Fixed in 97.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. It provides a robust set of features for enterprise-level applications, including user management, content management, and collaboration tools. The ComboServlet is a component within Liferay that combines multiple files into a single response to optimize loading times. However, it has a vulnerability that allows attackers to exploit it by creating excessively large responses, leading to potential denial of service.
Vulnerability Detail
The vulnerability in the ComboServlet arises from its failure to limit the number or size of files that can be combined. This oversight allows remote attackers to craft requests that result in very large responses, overwhelming the server and potentially causing it to become unresponsive. This can lead to denial of service, affecting the availability of the application for legitimate users. The vulnerability affects multiple versions of Liferay Portal and Liferay DXP, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
97.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement request validation to limit the number and size of files that can be processed by the ComboServlet. This can be done by adding checks in the servlet code to reject requests that exceed certain thresholds.
Conclusion
The vulnerability CVE-2025-62254 in Liferay Portal's ComboServlet poses a significant risk of denial of service due to its inability to limit file sizes. Users are advised to update to the latest version to mitigate this risk and ensure the continued availability of their applications.
See every vulnerability recorded for com.liferay.portal:com.liferay.portal.impl →
FAQ
CVE-2025-62254 is a vulnerability in Liferay Portal's ComboServlet that allows attackers to create large responses, leading to denial of service.
Affected versions include Liferay Portal 7.4.0 through 7.4.3.111, Liferay DXP 2023.Q4.0 through 2023.Q4.2, and older unsupported versions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. You can also check your application in the Vulert playground without signup.
The main consequence is denial of service, where legitimate users may be unable to access the application due to server overload.
Update your pom.xml to include the patched version (97.0.0 or later) and rebuild your application to apply the changes.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:com.liferay.portal.impl.
