CVE-2025-43801: Liferay DXP XML-RPC DoS Vulnerability

CVE-2025-43801 Overview

CVE-2025-43801 is an unchecked input for loop condition vulnerability affecting the XML-RPC component in Liferay Portal and Liferay Digital Experience Platform (DXP). This vulnerability allows remote attackers to perform denial-of-service (DoS) attacks by sending a crafted XML-RPC request. The flaw exists in multiple versions of the Liferay platform, including Portal versions 7.4.0 through 7.4.3.111 and various DXP releases spanning from version 7.3 through the 2023.Q4.0 quarterly release.

Critical Impact

Remote attackers can cause service disruption by exploiting the unchecked loop condition in XML-RPC request processing, potentially rendering affected Liferay instances unavailable.

Affected Products

• Liferay Portal 7.4.0 through 7.4.3.111 and older unsupported versions
• Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4
• Liferay DXP 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions

Discovery Timeline

• September 16, 2025 - CVE-2025-43801 published to NVD
• December 12, 2025 - Last updated in NVD database

Technical Details for CVE-2025-43801

Vulnerability Analysis

This vulnerability (CWE-606: Unchecked Input for Loop Condition) occurs when the XML-RPC component in Liferay fails to properly validate or limit input values that control loop iterations. When processing XML-RPC requests, the application does not adequately check user-supplied input that determines how many times a loop executes. An attacker can exploit this by crafting malicious XML-RPC requests containing extremely large iteration values, causing the server to enter long-running or infinite loops that consume excessive CPU and memory resources.

The vulnerability is accessible over the network without requiring authentication, meaning any remote attacker who can reach the XML-RPC endpoint can trigger the denial-of-service condition. This makes internet-facing Liferay deployments particularly vulnerable.

Root Cause

The root cause lies in insufficient input validation within the XML-RPC request processing logic. The application accepts user-controlled values for loop conditions without implementing proper bounds checking or resource limits. When these unchecked values are used to control iteration counts in loops, attackers can specify arbitrarily large values that exhaust server resources or cause the application to hang.

Attack Vector

The attack vector involves sending specially crafted XML-RPC requests to the vulnerable Liferay server. Since the vulnerability is network-accessible and requires no authentication or user interaction, an attacker simply needs to identify a vulnerable endpoint and submit malformed XML-RPC payloads. The crafted requests contain values designed to trigger excessive loop iterations, leading to CPU exhaustion and service unavailability.

The attack involves crafting an XML-RPC request with malicious values that control loop iterations in the Liferay XML-RPC handler. By specifying extremely large iteration counts, the attacker forces the server into resource-intensive processing that degrades or blocks service for legitimate users. For specific technical implementation details, refer to the Liferay Security Advisory CVE-2025-43801.

Detection Methods for CVE-2025-43801

Indicators of Compromise

• Unusual spikes in CPU utilization on Liferay application servers
• Abnormally high memory consumption in Liferay JVM processes
• Increased volume of XML-RPC requests from single or multiple IP addresses
• Application timeouts or unresponsiveness reported by users or monitoring systems

Detection Strategies

• Monitor XML-RPC endpoint access logs for anomalous request patterns or suspicious payloads
• Implement application performance monitoring (APM) to detect sudden resource consumption spikes
• Configure web application firewall (WAF) rules to inspect and rate-limit XML-RPC traffic
• Deploy network intrusion detection systems (IDS) with signatures for malformed XML-RPC requests

Monitoring Recommendations

• Set up alerting thresholds for CPU and memory utilization on Liferay servers
• Enable detailed logging for the XML-RPC component to capture request metadata
• Regularly review access logs for the XML-RPC endpoint for unusual activity patterns
• Implement synthetic transaction monitoring to detect service availability degradation

How to Mitigate CVE-2025-43801

Immediate Actions Required

• Update Liferay Portal to version 7.4.3.112 or later immediately
• Apply the latest security patches for Liferay DXP according to your subscription
• If patching is not immediately possible, consider disabling or restricting access to the XML-RPC endpoint
• Review firewall rules to limit XML-RPC endpoint access to trusted networks only

Patch Information

Liferay has addressed this vulnerability in updated releases. Organizations should upgrade to the latest patched versions of Liferay Portal or DXP. Detailed patch information is available in the Liferay Security Advisory CVE-2025-43801. Liferay customers with active subscriptions should contact Liferay support for specific fix pack or service pack guidance for their DXP version.

Workarounds

• Disable the XML-RPC API if it is not required for business operations
• Implement network-level access controls to restrict XML-RPC endpoint access to trusted IP ranges
• Deploy a reverse proxy or WAF with request size limits and rate limiting for XML-RPC traffic
• Configure resource limits on the application server to prevent single requests from consuming all available resources

# Example: Block external access to XML-RPC endpoint using iptables
iptables -A INPUT -p tcp --dport 8080 -m string --string "/api/xmlrpc" --algo bm -j DROP

# Example: Rate limit XML-RPC requests using nginx
# Add to nginx server configuration:
# location /api/xmlrpc {
#     limit_req zone=xmlrpc_limit burst=5 nodelay;
#     proxy_pass http://liferay_backend;
# }