CVE-2025-62266: Liferay Portal DNS Rebinding Vulnerability
Summary
CVE-2025-62266: Liferay Portal is vulnerable to DNS rebinding attacks. Affects com.liferay.portal:release.portal.bom versions >= 7.4.0-ga1, < 7.4.3.110. Fixed in 7.4.3.110. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform used for building web applications and managing content. It provides a robust framework for developers to create customized solutions for businesses. However, certain versions of Liferay Portal, specifically 7.4.0 through 7.4.3.119 and older unsupported versions, are vulnerable to DNS rebinding attacks, which can compromise user security.
Vulnerability Detail
The vulnerability arises from the way Liferay Portal handles redirect URLs. By default, versions 7.4.0 through 7.4.3.119 and various Liferay DXP versions are susceptible to DNS rebinding attacks. This allows remote attackers to redirect users to arbitrary external URLs, potentially leading to data theft or unauthorized access to sensitive information. The issue is classified under CWE-601, indicating a weakness in the application's handling of DNS responses.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.110
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can mitigate the risk of DNS rebinding attacks by changing the redirect URL security from IP to domain. This can be configured in the Liferay Portal settings to restrict the domains that can be used for redirects.
Conclusion
The DNS rebinding vulnerability in Liferay Portal poses a significant risk to users, allowing attackers to redirect them to malicious sites. It is crucial to update to the patched version or implement the recommended workaround to safeguard against potential exploits.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
A DNS rebinding attack allows an attacker to manipulate the DNS resolution process to redirect a user's browser to a malicious site, potentially exposing sensitive data.
Liferay Portal versions 7.4.0 through 7.4.3.119, older unsupported versions, and specific Liferay DXP versions are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
If you cannot update to the fixed version, implement the recommended workaround by changing the redirect URL security settings to mitigate the risk.
The CVSS score of this vulnerability is 5.1, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
