CVE-2025-43796: 
Java vulnerability analysis and mitigation

A vulnerability has been identified in Liferay Portal and DXP systems affecting versions 7.4.0 through 7.4.3.101, DXP 2023.Q3.0 through 2023.Q3.4, DXP 7.4 GA through update 92, and DXP 7.3 GA through update 35. The vulnerability (CVE-2025-43796) was disclosed on September 12, 2025, and involves an unrestricted number of objects returned from GraphQL queries (Liferay Advisory).

The vulnerability stems from the absence of pagination limits in GraphQL query responses. This implementation flaw has been assigned a CVSS v4.0 Base Score of 7.1 (High), with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) (NVD).

The vulnerability can be exploited to perform denial-of-service (DoS) attacks on affected applications by executing queries that return an excessive number of objects, potentially exhausting system resources (Liferay Advisory).

Fixed versions have been released to address this vulnerability: Liferay Portal 7.4.3.102, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 U36. Users are advised to upgrade to these patched versions (Liferay Advisory).