CVE-2025-62260: 
Java vulnerability analysis and mitigation

CVE-2025-62260 is a vulnerability discovered in Liferay Portal and Liferay DXP that was disclosed on October 27, 2025. The vulnerability affects multiple versions including Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP versions 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions (NVD, Liferay Advisory).

The vulnerability stems from the application's failure to limit the number of objects returned from Headless API requests. It has been assigned a CVSS v4.0 score of 7.1 (High) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, and a CVSS v3.1 score of 7.5 (High). The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption) (NVD, Miggo).

The vulnerability allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing requests that return a large number of objects, potentially affecting the availability of the system (Liferay Advisory).

The vulnerability has been fixed in Liferay Portal version 7.4.3.100 and Liferay DXP versions 2024.Q1.1, 2023.Q4.0, 2023.Q3.5, and 7.3 U36. Organizations are advised to upgrade to these patched versions to mitigate the vulnerability (Liferay Advisory).