Denial-of-Service Vulnerability in Kaleo Forms Admin of Liferay Portal and Liferay DXP

CVE-2025-43772

What is CVE-2025-43772?

The Kaleo Forms Admin component in Liferay Portal and Liferay DXP lacks proper restrictions on saving request parameters in the portlet session. This flaw enables remote attackers to exploit the system through specially crafted HTTP requests, potentially consuming system memory and leading to denial-of-service conditions. Users of affected versions are advised to implement necessary safeguards and monitor for unusual activity to mitigate the risk.

References