CVE-2025-43801: 
Java vulnerability analysis and mitigation

Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to perform denial-of-service (DoS) attacks via a crafted XML-RPC request. The vulnerability was disclosed on September 16, 2025 (Liferay Advisory, NVD).

The vulnerability has been assigned a CVSS v4.0 Base Score of 6.9 MEDIUM with the following vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. The vulnerability is classified as CWE-606 (Unchecked Input for Loop Condition) (NVD).

The vulnerability allows remote attackers to perform denial-of-service (DoS) attacks against affected Liferay Portal and DXP installations. The attack can be executed through a crafted XML-RPC request, potentially disrupting service availability (Liferay Advisory).

The vulnerability has been fixed in Liferay Portal 7.4.3.112, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 U36. Users are advised to upgrade to these or later versions (Liferay Advisory).