CVE-2025-43816: 
Java vulnerability analysis and mitigation

CVE-2025-43816 is a memory leak vulnerability in the headless API for StructuredContents in Liferay Portal and Liferay DXP that allows unauthenticated attackers to cause denial of service by repeatedly calling the affected API endpoint. It affects Liferay Portal 7.4.0 through 7.4.3.119 (and older unsupported versions), and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 (and older unsupported versions). The vulnerability was published on September 25, 2025. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Liferay Advisory).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), meaning the headless API for StructuredContents fails to properly release allocated memory after processing requests. An unauthenticated remote attacker can exploit this by sending repeated HTTP requests to the vulnerable StructuredContents headless API endpoint, causing progressive memory exhaustion on the server. The affected Maven package is com.liferay:com.liferay.portal.vulcan.impl, with versions below 5.0.115 being vulnerable. No special privileges or complex preconditions are required beyond network access to the API endpoint (GitHub Advisory, Liferay Advisory).

Successful exploitation results in server unavailability through a denial-of-service (DoS) condition, as repeated API calls cause memory to be allocated but never freed, eventually exhausting available server memory. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. In production environments, this could disrupt all services hosted on the affected Liferay instance, affecting end users and dependent business processes (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code known at this time, and no evidence of in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042% (0.000420), indicating a low probability of exploitation in the near term. The attack requires no authentication and no user interaction beyond the attacker's own repeated API calls, making it straightforward to attempt if a target is identified (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Liferay Portal or DXP instances using tools like Shodan or Censys, targeting versions within the affected ranges (Portal 7.4.0–7.4.3.119, DXP 7.4 GA–update 92, or quarterly releases through 2024.Q1.5).
2. Locate the StructuredContents headless API endpoint: The Liferay headless API for StructuredContents is typically accessible at paths such as /o/headless-delivery/v1.0/structured-contents or similar REST endpoints exposed by the com.liferay.portal.vulcan.impl module.
3. Send repeated API requests: Craft and send a high volume of HTTP GET or POST requests to the StructuredContents API endpoint without authentication, triggering memory allocation on each call.
4. Exhaust server memory: Continue sending requests in a loop or using a tool such as ab (Apache Benchmark), wrk, or a simple script, causing progressive memory leakage until the server's available memory is depleted and the service becomes unavailable (GitHub Advisory, Liferay Advisory).

• Network: Unusually high volume of repeated HTTP requests to /o/headless-delivery/v1.0/structured-contents or related StructuredContents API endpoints from a single or small set of source IPs.
• Logs: Liferay access logs showing a large number of requests to the StructuredContents headless API in a short time window; Java heap or OutOfMemoryError entries in Liferay server logs (catalina.out or liferay.log).
• Process/System: Steadily increasing JVM heap usage on the Liferay application server without corresponding release; server slowdowns or crashes correlating with API request spikes.
• Monitoring Alerts: Alerts from memory monitoring tools indicating heap usage approaching or exceeding configured thresholds on the Liferay host (GitHub Advisory).

Liferay has released a patch in Maven package com.liferay:com.liferay.portal.vulcan.impl version 5.0.115 and later. For Liferay Portal, upgrade to version 7.4.3.120 or later; for DXP, upgrade to 2024.Q1.6 or later in the Q1 series, or apply the latest available update in your respective release series. As interim workarounds, administrators should implement API rate limiting to restrict the number of requests to the StructuredContents headless API endpoint, monitor server memory usage with alerts for abnormal consumption, and consider restricting network-level access to the headless API if not required externally (GitHub Advisory, Liferay Advisory).