CVE-2025-43752: Liferay DXP DoS Vulnerability

CVE-2025-43752 Overview

CVE-2025-43752 affects Liferay Portal and Liferay Digital Experience Platform (DXP). The vulnerability lets authenticated users upload an unlimited number of files through object entries attachment fields. Uploaded files persist in the document_library, enabling storage exhaustion and a potential denial-of-service (DoS) condition on the host system.

The issue is classified under CWE-770: Allocation of Resources Without Limits or Throttling. It affects Liferay Portal versions 7.4.0 through 7.4.3.132 and multiple Liferay DXP release trains from 2024.Q1 through 2025.Q1, as well as 7.4 GA through update 92.

Critical Impact
An attacker with upload permissions can consume all available disk space via object entries attachment fields, causing service degradation or outage across Liferay Portal and DXP deployments.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132
Liferay DXP 2024.Q1.1 through 2025.Q1.4 (multiple release trains)
Liferay DXP 7.4 GA through update 92

Discovery Timeline

2025-08-22 - CVE-2025-43752 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43752

Vulnerability Analysis

The flaw resides in the object entries attachment field handler. Liferay Portal and DXP allow users to attach files to object entries but do not enforce a cap on the number or aggregate size of uploads. Each attachment is written to the document_library storage backend without quota checks tied to the object entry, the user, or the site.

Because the attack vector is network-based and requires only low privileges, an authenticated user with permission to interact with object entries can programmatically upload files in a loop. The uploaded content remains in persistent storage, meaning the impact accumulates over time rather than resetting between requests.

The vulnerability affects both confidentiality-adjacent and availability characteristics of the platform, but the primary risk is availability. When storage capacity is exhausted, the portal cannot write new documents, database transactions dependent on storage may fail, and administrative recovery requires manual cleanup of the document_library.

Root Cause

The root cause is missing resource limits on the object entries attachment upload path. Neither per-user nor per-object quotas are enforced, and file counts are not throttled. This is a classic instance of [CWE-770], where the application accepts requests to allocate resources indefinitely.

Attack Vector

Exploitation requires network access to the Liferay Portal instance and an authenticated session with permission to create or modify object entries. The attacker submits repeated attachment uploads to a target object entry field until the underlying file system or document repository storage is depleted. No user interaction beyond the attacker's own is required.

Refer to the Liferay Security Advisory CVE-2025-43752 for vendor-provided technical details.

Detection Methods for CVE-2025-43752

Indicators of Compromise

Rapid growth in the document_library directory or object storage bucket backing Liferay attachments.
High volume of POST requests from a single authenticated session to object entry attachment endpoints.
Repeated file uploads with identical or programmatically generated filenames tied to the same object entry.
Disk usage alerts on the Liferay application server or document repository host.

Detection Strategies

Monitor Liferay access logs for anomalous upload counts per user, per session, and per object entry.
Correlate storage utilization metrics with application-tier upload events to identify sudden ingestion spikes.
Baseline normal attachment activity per object type and alert on statistical outliers.

Monitoring Recommendations

Enable audit logging on the document_library service and object entry APIs.
Track authenticated user upload rates and cumulative uploaded bytes over rolling windows.
Set threshold alerts on storage volume growth exceeding expected daily baselines.

How to Mitigate CVE-2025-43752

Immediate Actions Required

Apply the Liferay-provided patch or upgrade to a fixed release identified in the Liferay Security Advisory.
Review permissions on object entries and restrict attachment upload rights to trusted users where possible.
Audit the document_library for anomalous file volumes attributable to individual users or object entries.

Patch Information

Liferay has published guidance in the vendor advisory. Administrators should upgrade Liferay Portal beyond 7.4.3.132 and Liferay DXP to the fixed update level indicated by Liferay for each affected release train (2024.Q1, 2024.Q2, 2024.Q3, 2024.Q4, 2025.Q1, and 7.4 GA).

Workarounds

Configure file upload size and count limits at the reverse proxy or web application firewall (WAF) layer for object entry attachment endpoints.
Enforce per-user disk quotas at the operating system or storage backend where the document_library resides.
Restrict object entry attachment field permissions to a minimal set of roles until patching is complete.

bash

# Example NGINX reverse proxy limits for Liferay upload endpoints
client_max_body_size 10m;
limit_req_zone $binary_remote_addr zone=liferay_uploads:10m rate=5r/m;
location /o/ {
    limit_req zone=liferay_uploads burst=10 nodelay;
    proxy_pass http://liferay_backend;
}