CVE-2025-43816
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119 and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2024.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API endpoint.
Risk Assessment
An attacker could exhaust memory and cause Liferay server unavailability, disrupting application operations.
Recommendation
Update Liferay Portal/DXP to a patched version and restrict access to the headless API.
Other vulnerabilities in Liferay Portal and Liferay DXP
See all- CVE-2025-62259Medium
Liferay Portal 7.4.0 through 7.4.3.109 and Liferay DXP in specified versions do not limit API access before a user has verified their email address. Remote users can access and edit content via the API without email verification.
- CVE-2025-43790High
An Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance.
Original NVD description (English source)
A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2024.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS