VULNERABILITY INTELLIGENCE

CVE-2025-43796

CVSS score7.5 HIGH
EPSS probability0.38%
CISA KEVNot currently listed
Published2025-09-12
Last modified2026-10-18
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing queries that return a large number of objects.

Weakness classification

  • security@liferay.com: CWE-400

Primary references