Every CVE Search/ Get API key

CVE-2025-43736

Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

6.9 MediumFix available

A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile picture into the user profile. This size more than the noted max 300kb size. This extra amount of data can make Liferay slower.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.31%Up 0.3 points since Aug 12, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.9

A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile picture into the user profile. This size more than the noted max 300kb size. This extra amount of data can make Liferay slower.

Record
CVE-2025-43736
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2025-24251 6.9

A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile picture into the user profile. This size more than the noted max 300kb size. This extra amount of data can make Liferay slower.

Record
EUVD-2025-24251
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-cg99-m88x-422c 6.9

Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.

Record
GHSA-cg99-m88x-422c
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L
Weakness
CWE-770
Updated
2026-11-02
NVD 6.9

A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile picture into the user profile. This size more than the noted max 300kb size. This extra amount of data can make Liferay slower.

Record
CVE-2025-43736
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:X
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-770
Updated
2026-11-02
OSV 4.3

A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile picture into the user profile. This size more than the noted max 300kb size. This extra amount of data can make Liferay slower.

Record
CVE-2025-43736
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVGHSA-cg99-m88x-422c 6.9

Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.

Record
GHSA-cg99-m88x-422c
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L
Weakness
CWE-770
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
com.liferay.portal:release.portal.bom
Maven
 7.4.3.0 to 7.4.3.132 None known
com.liferay.portal:release.dxp.bom
Maven
 2025.Q1.0 to 2025.Q1.8
2025.Q1.9
com.liferay.portal:release.dxp.bom
Maven
 2024.Q4.0 to 2024.Q4.7 None known
com.liferay.portal:release.dxp.bom
Maven
 2024.Q3.0 to 2024.Q3.13 None known
com.liferay.portal:release.dxp.bom
Maven
 2024.Q2.0 to 2024.Q2.13 None known
com.liferay.portal:release.dxp.bom
Maven
 2024.Q1.0 to 2024.Q1.16
2024.Q1.17
com.liferay.portal:release.dxp.bom
Maven
 through 7.4.13.u92 None known
com.liferay:com.liferay.frontend.taglib
Maven
 before 13.10.0
13.10.0
com.liferay:com.liferay.image.uploader.web
Maven
 before 5.0.56
5.0.56
com.liferay:com.liferay.users.admin.web
Maven
 before 11.0.27
11.0.27
Show 12 moreShow less
Affected packages
PackageAffectedFixed
com.liferay:com.liferay.account.admin.web
Maven
 before 2.0.138
2.0.138
com.liferay.portal:release.portal.bom
Maven
 7.4.3.0 to 7.4.3.132, plus listed versions
7.4.3.107.4.3.1007.4.3.1017.4.3.1027.4.3.103
Show 45 moreShow less
7.4.3.1047.4.3.1057.4.3.1067.4.3.1077.4.3.117.4.3.1127.4.3.112-ga1127.4.3.127.4.3.1207.4.3.120-ga1207.4.3.1257.4.3.125-ga1257.4.3.1297.4.3.137.4.3.147.4.3.157.4.3.167.4.3.177.4.3.187.4.3.197.4.3.207.4.3.20-ga207.4.3.217.4.3.21-ga217.4.3.227.4.3.237.4.3.247.4.3.257.4.3.267.4.3.277.4.3.287.4.3.297.4.3.307.4.3.317.4.3.327.4.3.337.4.3.347.4.3.357.4.3.367.4.3.377.4.3.387.4.3.397.4.3.47.4.3.407.4.3.41
 None known
com.liferay.portal:release.dxp.bom
Maven
 2025.Q1.0 up to 2025.Q1.9, plus listed versions
2025.q1.02025.q1.12025.q1.22025.q1.32025.q1.4
Show 4 moreShow less
2025.q1.52025.q1.62025.q1.72025.q1.8
2025.Q1.9
com.liferay.portal:release.dxp.bom
Maven
 2024.Q4.0 to 2024.Q4.7, plus listed versions
2024.q4.02024.q4.12024.q4.22024.q4.32024.q4.42024.q4.52024.q4.62024.q4.7
 None known
com.liferay.portal:release.dxp.bom
Maven
 2024.Q3.0 to 2024.Q3.13, plus listed versions
2024.q3.02024.q3.12024.q3.102024.q3.112024.q3.12
Show 9 moreShow less
2024.q3.132024.q3.22024.q3.32024.q3.42024.q3.52024.q3.62024.q3.72024.q3.82024.q3.9
 None known
com.liferay.portal:release.dxp.bom
Maven
 2024.Q2.0 to 2024.Q2.13, plus listed versions
2024.q2.02024.q2.12024.q2.102024.q2.112024.q2.12
Show 9 moreShow less
2024.q2.132024.q2.22024.q2.32024.q2.42024.q2.52024.q2.62024.q2.72024.q2.82024.q2.9
 None known
com.liferay.portal:release.dxp.bom
Maven
 2024.Q1.0 up to 2024.Q1.17, plus listed versions
2024.q1.12024.q1.102024.q1.112024.q1.122024.q1.13
Show 11 moreShow less
2024.q1.142024.q1.152024.q1.162024.q1.22024.q1.32024.q1.42024.q1.52024.q1.62024.q1.72024.q1.82024.q1.9
2024.Q1.17
com.liferay.portal:release.dxp.bom
Maven
 through 7.4.13.u92, plus listed versions
7.0.10.147.0.10.14-17.0.10.167.0.10.177.0.10.7
Show 45 moreShow less
7.0.10.87.0.10.97.0.10.fp1007.0.10.fp1017.0.10.fp1027.0.10.fp607.0.10.fp617.0.10.fp627.0.10.fp637.0.10.fp647.0.10.fp657.0.10.fp667.0.10.fp677.0.10.fp687.0.10.fp697.0.10.fp707.0.10.fp717.0.10.fp727.0.10.fp737.0.10.fp747.0.10.fp757.0.10.fp767.0.10.fp777.0.10.fp787.0.10.fp797.0.10.fp807.0.10.fp817.0.10.fp827.0.10.fp837.0.10.fp847.0.10.fp857.0.10.fp85-17.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp887.0.10.fp897.0.10.fp907.0.10.fp917.0.10.fp927.0.10.fp947.0.10.fp94-17.0.10.fp957.0.10.fp95-1
 None known
com.liferay:com.liferay.frontend.taglib
Maven
 before 13.10.0, plus listed versions
1.0.01.0.11.0.21.1.010.0.0
Show 45 moreShow less
10.0.110.0.210.1.010.1.111.0.011.1.011.2.011.2.111.2.211.3.012.0.012.1.012.1.112.1.212.2.012.3.012.3.112.3.212.3.312.3.412.3.512.3.613.0.013.1.013.1.113.1.213.2.013.2.113.3.013.3.113.4.013.5.013.5.113.5.213.5.313.5.413.6.013.6.113.6.213.6.313.6.413.6.513.6.613.6.713.6.8
13.10.0
com.liferay:com.liferay.image.uploader.web
Maven
 before 5.0.56, plus listed versions
1.0.01.0.11.0.101.0.111.0.12
Show 45 moreShow less
1.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.201.0.211.0.221.0.231.0.241.0.251.0.261.0.271.0.281.0.291.0.31.0.301.0.311.0.321.0.331.0.341.0.351.0.361.0.371.0.381.0.391.0.41.0.401.0.411.0.421.0.431.0.441.0.451.0.461.0.471.0.481.0.491.0.51.0.61.0.71.0.81.0.9
5.0.56
com.liferay:com.liferay.users.admin.web
Maven
 before 11.0.27, plus listed versions
1.0.01.0.11.0.21.0.31.0.4
Show 45 moreShow less
10.0.010.0.110.0.210.0.310.0.410.0.511.0.011.0.111.0.1011.0.1111.0.1211.0.1311.0.1411.0.1511.0.1611.0.1711.0.1811.0.1911.0.211.0.2011.0.2111.0.2211.0.2311.0.2411.0.2511.0.2611.0.311.0.411.0.511.0.611.0.711.0.811.0.92.0.02.0.12.0.102.0.112.0.122.0.132.0.142.0.152.0.162.0.172.0.182.0.19
11.0.27
com.liferay:com.liferay.account.admin.web
Maven
 before 2.0.138, plus listed versions
1.0.01.0.11.0.101.0.111.0.12
Show 45 moreShow less
1.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.201.0.211.0.221.0.231.0.241.0.251.0.261.0.271.0.281.0.291.0.31.0.301.0.311.0.321.0.331.0.341.0.351.0.361.0.371.0.381.0.391.0.41.0.401.0.411.0.421.0.431.0.441.0.451.0.461.0.471.0.481.0.491.0.51.0.501.0.511.0.521.0.53
2.0.138

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-43736 is a medium vulnerability (CVSS 6.9) in Liferay Dxp, published August 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in com.liferay.portal:release.dxp.bom 2025.Q1.9.

References

This page doesn't list everything

Left out here: 1,454 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open