CVE-2025-43762: Liferay DXP DoS Vulnerability

CVE-2025-43762 Overview

CVE-2025-43762 affects Liferay Portal and Liferay Digital Experience Platform (DXP). The vulnerability allows unauthenticated users to upload an unlimited number of files through the forms feature. Uploaded files are persisted in the document_library, providing an attacker a mechanism to exhaust storage and induce a denial-of-service (DDoS) condition.

The flaw is tracked as an uncontrolled resource consumption issue [CWE-770]. It affects Liferay Portal 7.4.0 through 7.4.3.132, Liferay 7.4 GA through update 92, and multiple 2024.Q1 through 2025.Q1 DXP releases.

Critical Impact
Unauthenticated attackers can flood the Liferay document library with arbitrary form uploads, exhausting disk capacity and degrading service availability across the portal.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132
Liferay DXP 7.4 GA through update 92
Liferay DXP 2024.Q1.1–2024.Q1.14, 2024.Q2.0–2024.Q2.13, 2024.Q3.1–2024.Q3.13, 2024.Q4.0–2024.Q4.7, 2025.Q1.0–2025.Q1.1

Discovery Timeline

2025-08-22 - CVE CVE-2025-43762 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43762

Vulnerability Analysis

The vulnerability resides in the Liferay Forms component, which accepts file attachments from form submissions. The submission handler does not enforce an upper bound on the number of files that a single user, session, or form can upload. Each accepted file is written to the portal document_library, which is backed by the underlying filesystem or object store.

Repeated submissions produce unbounded resource consumption. Storage growth eventually degrades portal responsiveness and can render dependent services unavailable. This is a classic uncontrolled resource consumption pattern where a legitimate feature — form-driven file capture — lacks quota enforcement.

The attack does not require valid credentials on public-facing forms. The CVSS 4.0 vector indicates network-based exploitation with low complexity and passive user interaction, and impact is limited to integrity and availability of stored data.

Root Cause

The root cause is a missing quota or rate limit on file uploads submitted through the Forms feature. Liferay's document library persistence layer accepts each file passed by the form handler without verifying cumulative counts, submission velocity, or storage budget per principal.

Attack Vector

An attacker locates a public Liferay form that includes a file upload field. The attacker then submits large volumes of form entries, each carrying attachments, either through the rendered form endpoint or through scripted HTTP POST requests. Automation permits sustained submissions until the underlying storage is exhausted or performance collapses.

No authentication is required when the form is exposed publicly. No verified public proof-of-concept has been published for CVE-2025-43762 at the time of writing. Refer to the Liferay Security Advisory CVE-2025-43762 for vendor-provided technical detail.

Detection Methods for CVE-2025-43762

Indicators of Compromise

Rapid growth of the Liferay document_library storage volume without a corresponding business event.
High volume of form submission events from a single source IP, user agent, or session identifier within a short window.
A disproportionate number of small or identical file attachments in the document library associated with a single form.
Repeated HTTP POST requests to Liferay form submission endpoints with multipart/form-data bodies.

Detection Strategies

Baseline normal form submission rates per form, per source IP, and per authenticated user, then alert on statistical outliers.
Correlate web server access logs with document library write events to identify uploads not tied to expected business workflows.
Inspect stored files for repeated hashes, minimal size, or generated content that suggests automated flooding.

Monitoring Recommendations

Monitor filesystem or object storage utilization backing the document_library and alert on abnormal growth rates.
Log and review all form submissions containing file attachments, including source IP, form identifier, and submission timestamp.
Track Liferay application performance metrics (response latency, thread pool saturation) that would signal resource pressure from a flood.

How to Mitigate CVE-2025-43762

Immediate Actions Required

Apply the Liferay-provided fix as documented in the Liferay Security Advisory CVE-2025-43762.
Audit all published forms for file upload fields and disable or restrict any that do not require attachments.
Enforce authentication or CAPTCHA on public forms that accept file uploads.

Patch Information

Upgrade to a fixed Liferay Portal or Liferay DXP release as published in the vendor advisory. Administrators running Liferay Portal 7.4.0–7.4.3.132, DXP 7.4 GA through update 92, or the affected 2024.Q1 through 2025.Q1 quarterly releases should consult the advisory for the exact fixed build and apply it during the next maintenance window.

Workarounds

Configure a reverse proxy or web application firewall (WAF) to rate-limit multipart/form-data POST requests to Liferay form endpoints.
Set per-user and per-form upload quotas and maximum file size constraints in Liferay administration.
Restrict anonymous access to forms containing file upload fields until the patch is applied.
Monitor document_library storage with hard alerting thresholds so operators can respond before capacity is exhausted.

bash

# Example nginx rate limit for Liferay form submission endpoints
limit_req_zone $binary_remote_addr zone=liferay_forms:10m rate=5r/m;

server {
    location ~ ^/o/dynamic-data-mapping-form/ {
        limit_req zone=liferay_forms burst=10 nodelay;
        client_max_body_size 5m;
        proxy_pass http://liferay_upstream;
    }
}