Denial-of-Service Vulnerability in Liferay Portal and Liferay DXP

CVE-2025-62260

What is CVE-2025-62260?

The affected versions of Liferay Portal and Liferay DXP have a significant vulnerability in their Headless API functionality. This flaw does not impose restrictions on the number of objects that can be retrieved in API requests. As a result, malicious users can craft requests that yield excessively large data sets, leading to potential denial-of-service attacks. These attacks can overload the system, disrupt normal operations, and degrade service availability, posing a considerable risk to businesses relying on these applications.

References