Denial-of-Service Vulnerability in Kaleo Forms Admin of Liferay Portal and Liferay DXP

CVE-2025-43772

What is CVE-2025-43772?

The Kaleo Forms Admin component in Liferay Portal and Liferay DXP lacks proper restrictions on saving request parameters in the portlet session. This flaw enables remote attackers to exploit the system through specially crafted HTTP requests, potentially consuming system memory and leading to denial-of-service conditions. Users of affected versions are advised to implement necessary safeguards and monitor for unusual activity to mitigate the risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References