BaseFortify

Publication date: 2025-10-27

Last updated on: 2025-11-10

Assigner: Liferay Inc.

Description

Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-27

Last Modified

2025-11-10

Generated

2026-07-06

AI Q&A

2025-10-27

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62260

Affected Vendors & Products

Vendor	Product	Version / Range
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.3
liferay	digital_experience_platform	7.4
liferay	digital_experience_platform	2023.q3.1
liferay	digital_experience_platform	2023.q3.2
liferay	digital_experience_platform	2023.q3.3
liferay	digital_experience_platform	2023.q3.4
liferay	liferay_portal	From 7.4.0 (inc) to 7.4.3.99 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability exists in certain versions of Liferay Portal and Liferay DXP where the Headless API does not limit the number of objects returned in a request. This allows a remote attacker to send a request that returns a very large number of objects, potentially overwhelming the application and causing a denial-of-service (DoS) condition.

Impact Analysis

The vulnerability can impact you by allowing remote attackers to perform denial-of-service (DoS) attacks on your Liferay Portal or DXP application. This can lead to service disruption, making the application unavailable to legitimate users.

Hi! I’m here to help you understand CVE-2025-62260. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70