Executive Summary

CVE-2025-43764 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Role Name search field of the Kaleo Designer portlet's JavaScript in Liferay Portal and Liferay DXP. Authenticated users with permissions to update Kaleo Workflows can input a malicious regular expression pattern that causes their browser to hang for a long time, effectively causing a denial of service. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the browser of an authenticated user with workflow update permissions to hang or become unresponsive for an extended period when processing a malicious regular expression. This results in a denial of service, potentially disrupting workflow updates and user productivity. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection involves verifying if your Liferay Portal or Liferay DXP installation is within the affected versions and if users with permissions to update Kaleo Workflows have input malicious regex patterns in the Role Name search field of the Kaleo Designer portlet. Since the vulnerability causes the browser to hang when processing malicious regex, monitoring for unusual browser hangs or performance degradation during Role Name searches can be indicative. There are no specific commands provided to detect this vulnerability directly. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading your Liferay Portal or Liferay DXP to the fixed versions: Liferay Portal 7.4.3.132, Liferay DXP 2024.Q4.2, or Liferay DXP 2025.Q1.0. Additionally, restrict permissions to update Kaleo Workflows to trusted users only, and monitor or audit inputs to the Role Name search field to prevent malicious regex patterns from being entered. [1]

Useful 0 Not Useful 0