CVE-2025-43796: 
Liferay Portal 脆弱性の分析と軽減

Liferay Portal and Liferay DXP contain a vulnerability where GraphQL queries are not limited in the number of objects they can return. The vulnerability, identified as CVE-2025-43796, affects multiple versions including Liferay Portal 7.4.0 through 7.4.3.101, Liferay DXP 2023.Q3.0 through 2023.Q3.4, Liferay DXP 7.4 GA through update 92, and Liferay DXP 7.3 GA through update 35. The vulnerability was disclosed on September 12, 2025 (Liferay Advisory).

The vulnerability has been assigned a CVSS v4.0 base score of 7.1 (HIGH) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. The technical issue stems from the lack of pagination limits in GraphQL queries, which can be exploited remotely. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) (NVD).

When exploited, this vulnerability allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing queries that return a large number of objects. This can potentially impact the availability of the affected Liferay services (Liferay Advisory).

The vulnerability has been fixed in the following versions: Liferay Portal 7.4.3.102, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 U36. Users are advised to upgrade to these patched versions to mitigate the vulnerability (Liferay Advisory).