Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries.
Severity
High 8.7
Published
16 Jun 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD
Affected software
Software
Affected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
From 2023.q3.1 up to 2023.q3.2
Version 7.4
Version 7.3-update35
Version 7.3-update34
All 56 release lines
Version 7.2-fix_pack_8
Version 7.2-fix_pack_9
Version 7.2-fix_pack_10
Version 7.2-fix_pack_11
Version 7.2-fix_pack_12
Version 7.2-fix_pack_13
Version 7.2-fix_pack_14
Version 7.2-fix_pack_15
Version 7.2-fix_pack_16
Version 7.2-fix_pack_17
Version 7.2-fix_pack_18
Version 7.2-fix_pack_19
Version 7.2-fix_pack_20
Version 7.3
Version 7.3-fix_pack_1
Version 7.3-fix_pack_2
Version 7.3-service_pack_1
Version 7.3-service_pack_2
Version 7.3-service_pack_3
Version 7.3-update1
Version 7.3-update2
Version 7.3-update3
Version 7.3-update4
Version 7.3-update5
Version 7.3-update6
Version 7.3-update7
Version 7.3-update8
Version 7.3-update9
Version 7.3-update10
Version 7.3-update11
Version 7.3-update12
Version 7.3-update13
Version 7.3-update14
Version 7.3-update15
Version 7.3-update16
Version 7.3-update17
Version 7.3-update18
Version 7.3-update19
Version 7.3-update20
Version 7.3-update21
Version 7.3-update22
Version 7.3-update23
Version 7.3-update24
Version 7.3-update25
Version 7.3-update26
Version 7.3-update27
Version 7.3-update28
Version 7.3-update29
Version 7.3-update30
Version 7.3-update31
Version 7.3-update32
Version 7.3-update33
Version 7.3-update34
Version 7.3-update35
Version 7.4
From 2023.q3.1 up to 2023.q3.2
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal