CVE-2025-43764 Overview
CVE-2025-43764 is a Self-Regular Expression Denial of Service (Self-ReDoS) vulnerability in the Kaleo Designer portlet of Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the client-side JavaScript that powers the Role Name search field. An authenticated user with permissions to update Kaleo Workflows can supply a malicious regex pattern that triggers catastrophic backtracking in the browser. The result is a hang that affects the user's own browser session rather than the server. The issue is tracked under CWE-1333: Inefficient Regular Expression Complexity.
Critical Impact
An authenticated Kaleo Workflow editor can freeze their own browser session by entering a crafted regex into the Role Name search field, disrupting workflow administration.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.131, and 7.4 GA through update 92
- Liferay DXP 2024.Q4.0 through 2024.Q4.1, 2024.Q3.0 through 2024.Q3.13
- Liferay DXP 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20
Discovery Timeline
- 2025-08-23 - CVE-2025-43764 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43764
Vulnerability Analysis
The vulnerability affects the JavaScript executed in the browser when using the Role Name search field within the Kaleo Designer portlet. Liferay's Kaleo Designer is the visual authoring tool for Kaleo workflow definitions, and Role Name search is used to associate roles with workflow tasks. The client-side code accepts user input and applies it as a regular expression against role data without bounding the evaluation. A pattern containing nested quantifiers or ambiguous alternation forces the regex engine into exponential backtracking. The browser tab performing the evaluation stops responding for an extended period, blocking further administrative activity in that session.
Root Cause
The underlying weakness is inefficient regular expression complexity ([CWE-1333]). The portlet's search filter converts unsanitized user input into a regex executed inside the browser's JavaScript engine. Because the regex is not validated, precompiled to a safe form, or executed under a timeout, adversarial patterns cause catastrophic backtracking on the user's machine.
Attack Vector
Exploitation requires an authenticated account with permission to update Kaleo Workflows, so this is a privileged-user, self-inflicted denial of service (Self-ReDoS). The attacker types or pastes a malicious pattern such as one containing overlapping quantifiers into the Role Name search field. The evaluation happens client-side, so the impact is confined to the browser process of the user who submitted the pattern. Server availability, other tenants, and other Liferay users are not directly affected. The practical risk is workflow administrators being tricked (for example, via a shared link or copy-paste lure) into pasting a payload that stalls their session.
No verified proof-of-concept code is currently published for this CVE. Refer to the Liferay Security Advisory CVE-2025-43764 for vendor-supplied technical details.
Detection Methods for CVE-2025-43764
Indicators of Compromise
- Reports from workflow administrators of unresponsive browser tabs while working in Kaleo Designer, particularly on the Role Name search field.
- Unusually long-running JavaScript execution warnings ("Page unresponsive") tied to /o/kaleo-designer/ or Kaleo Designer portlet URLs in browser telemetry.
- Access logs showing repeated navigation to Kaleo Designer role selection views by the same authenticated account without corresponding workflow updates.
Detection Strategies
- Audit Liferay access logs for authenticated requests to the Kaleo Designer portlet and correlate with user reports of browser hangs.
- Review Liferay audit records for accounts that hold the permission to update Kaleo Workflows and flag unexpected assignees.
- Monitor endpoint telemetry for browser processes consuming sustained high CPU while a Liferay administrative tab is open.
Monitoring Recommendations
- Track the current running versions of Liferay Portal and DXP across the estate and compare against the fixed releases in the vendor advisory.
- Alert on privilege changes that grant the ability to update Kaleo Workflows so scope remains limited to trusted administrators.
- Include the Liferay administrative interface in periodic user-experience health checks to surface hangs that may indicate ReDoS attempts.
How to Mitigate CVE-2025-43764
Immediate Actions Required
- Apply the fixed release identified in the Liferay Security Advisory CVE-2025-43764 to all affected Portal and DXP instances.
- Review and minimize the set of users granted permission to update Kaleo Workflows, since exploitation requires that privilege.
- Advise workflow administrators not to paste untrusted content into the Kaleo Designer Role Name search field until patching is complete.
Patch Information
Liferay has published a security advisory for CVE-2025-43764 with remediation guidance and fixed versions for both Liferay Portal 7.4 and Liferay DXP quarterly releases. Consult the Liferay Security Advisory CVE-2025-43764 for the specific update or DXP quarterly release that addresses the flaw for your deployment.
Workarounds
- Restrict the Kaleo Workflow update permission to a small, trusted group of administrators via Liferay role management.
- Instruct affected users to close and reopen the browser tab if a hang occurs; the condition resolves once the tab process is terminated.
- Where feasible, deploy a Web Application Firewall or reverse-proxy rule to log and inspect requests to Kaleo Designer endpoints for unusual input patterns.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
