Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.
Severity
High 7.1
Published
27 Oct 2025
Last changed
18 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.4.3.99
Sources
NVD
Affected software
Software
Affected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
Version 2023.q3.4
Version 2023.q3.3
Version 2023.q3.2
Version 2023.q3.1
All 46 release lines
Version 7.3
Version 7.3-fix_pack_1
Version 7.3-fix_pack_2
Version 7.3-service_pack_1
Version 7.3-service_pack_2
Version 7.3-service_pack_3
Version 7.3-update1
Version 7.3-update2
Version 7.3-update3
Version 7.3-update4
Version 7.3-update5
Version 7.3-update6
Version 7.3-update7
Version 7.3-update8
Version 7.3-update9
Version 7.3-update10
Version 7.3-update11
Version 7.3-update12
Version 7.3-update13
Version 7.3-update14
Version 7.3-update15
Version 7.3-update16
Version 7.3-update17
Version 7.3-update18
Version 7.3-update19
Version 7.3-update20
Version 7.3-update21
Version 7.3-update22
Version 7.3-update23
Version 7.3-update24
Version 7.3-update25
Version 7.3-update26
Version 7.3-update27
Version 7.3-update28
Version 7.3-update29
Version 7.3-update30
Version 7.3-update31
Version 7.3-update32
Version 7.3-update33
Version 7.3-update34
Version 7.3-update35
Version 7.4
Version 2023.q3.1
Version 2023.q3.2
Version 2023.q3.3
Version 2023.q3.4
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal