Memory Leak Vulnerability in Liferay Portal and DXP Products
CVE-2025-43816

6.9MEDIUM

Key Information:

Vendor

Liferay
Status
Portal
Dxp
Vendor
CVE Published:
25 September 2025

What is CVE-2025-43816?

The memory leak in the headless API for StructuredContents within Liferay Portal and DXP allows attackers to exploit the API endpoint repeatedly. This results in significant resource drainage and can lead to server unavailability, impacting users' access to services. Environments running vulnerable versions are strongly advised to adopt patches or updates to mitigate this risk.

Affected Version(s)

DXP 7.4.13 <= 7.4.13-u92

DXP 2023.Q3.1 <= 2023.Q3.10

DXP 2023.Q4.0 <= 2023.Q4.10

References

https://liferay.dev/portal/security/known-vulnerabilities...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-43816 : Memory Leak Vulnerability in Liferay Portal and DXP Products