Denial of Service Vulnerability in Liferay Portal and DXP Software

CVE-2025-3526

What is CVE-2025-3526?

A vulnerability in Liferay Portal versions 7.0.0 to 7.4.3.21 and Liferay DXP versions 7.3 GA to update 25 allows remote attackers to exploit session management flaws. Specifically, the software does not adequately restrict the saving of request parameters in the HTTP session. This oversight can lead to excessive consumption of system memory, potentially resulting in denial-of-service (DoS) conditions through specially crafted HTTP requests. Organizations using affected versions should review the vulnerability details and take appropriate action to mitigate risks.

References