CVE-2025-62260: Liferay Portal Denial-of-Service Vulnerability via Headless API Requests
Summary
CVE-2025-62260: Liferay Portal Vulnerable to DoS via Crafted Headless API Request. Affects com.liferay.portal:release.portal.bom versions >= 7.4.0-ga1, < 7.4.3.100. Fixed in 7.4.3.100. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform used for building web applications and managing digital experiences. It provides a wide range of features, including content management, collaboration tools, and integration capabilities. The platform's Headless API allows developers to interact with Liferay services programmatically, enabling the creation of dynamic applications. However, certain versions of Liferay Portal are vulnerable to a denial-of-service (DoS) attack due to the lack of limits on the number of objects returned in API requests.
Vulnerability Detail
The vulnerability in Liferay Portal arises from its Headless API, which does not impose restrictions on the number of objects that can be returned in a single request. This oversight allows remote attackers to craft requests that return excessively large datasets, potentially overwhelming the application and leading to service disruptions. The affected versions include Liferay Portal 7.4.0 through 7.4.3.99 and Liferay DXP 2023.Q3.1 through 2023.Q3.4, among others. The lack of input validation and rate limiting contributes to the severity of this issue, categorized under CWE-400 (Uncontrolled Resource Consumption).
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.100
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting or pagination in your API requests to mitigate the impact of this vulnerability until a proper update can be applied. This can be achieved by modifying the API endpoints to accept parameters that limit the number of objects returned in a single request.
Conclusion
The vulnerability identified as CVE-2025-62260 poses a significant risk to Liferay Portal users, allowing potential denial-of-service attacks via crafted Headless API requests. It is crucial for users to update to the latest patched version to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
The vulnerability affects Liferay Portal versions 7.4.0 through 7.4.3.99, Liferay DXP 2023.Q3.1 through 2023.Q3.4, and older unsupported versions.
A denial-of-service attack aims to make a service unavailable to its intended users by overwhelming it with excessive requests or exploiting vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your pom.xml file to the Vulert playground, you can check for vulnerabilities without needing to sign up.
If immediate updates are not possible, implement rate limiting or pagination in your API requests to reduce the risk of DoS attacks until you can apply the patch.
Detailed information about this vulnerability can be found in the advisory published on GitHub and other security databases.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
