CVE-2025-43801: 
Java vulnerability analysis and mitigation

CVE-2025-43801 is an unchecked input for loop condition vulnerability discovered in XML-RPC functionality of Liferay Portal and Liferay DXP. The vulnerability was disclosed on September 16, 2025, affecting multiple versions including Liferay Portal 7.4.0 through 7.4.3.111 and Liferay DXP versions 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 (Liferay Advisory).

The vulnerability is classified as CWE-606 (Unchecked Input for Loop Condition). It received a CVSS v4.0 score of 6.9 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. The vulnerability exists in the XML-RPC component and can be exploited through crafted XML-RPC requests (NVD).

When successfully exploited, this vulnerability allows remote attackers to perform denial-of-service (DoS) attacks against the affected systems. The attack can be executed without requiring authentication or user interaction (Liferay Advisory).

The vulnerability has been patched in the following versions: Liferay Portal 7.4.3.112, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 U36. Users are advised to upgrade to these fixed versions to mitigate the vulnerability (Liferay Advisory).