CVE-2025-62260: Liferay DXP Headless API DoS Vulnerability

CVE-2025-62260 Overview

CVE-2025-62260 is a denial-of-service (DoS) vulnerability in Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw stems from missing limits on the number of objects returned by Headless API requests. Authenticated remote attackers can issue requests that force the application to return excessively large result sets, exhausting server resources and degrading service availability. The vulnerability is tracked as an uncontrolled resource consumption issue [CWE-400].

Critical Impact

Authenticated attackers can trigger application-level denial of service by requesting large object collections through Headless APIs, impacting availability for all users of the affected Liferay instance.

Affected Products

• Liferay Portal 7.4.0 through 7.4.3.99
• Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35
• Older unsupported Liferay Portal and DXP versions

Discovery Timeline

• 2025-10-27 - CVE-2025-62260 published to NVD
• 2025-11-10 - Last updated in NVD database

Technical Details for CVE-2025-62260

Vulnerability Analysis

Liferay exposes Headless APIs that allow programmatic access to portal objects, content, and configuration data. The affected endpoints fail to enforce an upper bound on the number of objects returned in a single response. When a client requests a collection, the server materializes and serializes the entire result set instead of paginating or capping responses to a safe maximum. Processing oversized result sets consumes excessive memory, CPU, and database connections. A single low-privileged user can repeat these requests and drive the application into an unresponsive state, denying service to legitimate users.

Root Cause

The root cause is a missing server-side pagination ceiling on Headless API list operations. The application honors client-supplied page-size parameters or returns full collections without comparing requested counts against a hardcoded safe maximum. This is a classic uncontrolled resource consumption pattern [CWE-400] in REST API design where input validation does not extend to result-set sizing.

Attack Vector

Exploitation requires network access to the Headless API and low-level authenticated privileges. The attacker sends an HTTP request to a Headless API list endpoint specifying a large page size or querying a collection known to contain many records. The server attempts to load and serialize all matching objects, consuming heap memory and blocking worker threads. Repeated requests amplify the impact and can crash the JVM or render the portal unresponsive. The vulnerability does not allow data modification or disclosure, but availability impact is high. The Liferay security advisory should be consulted for the exact endpoints and parameters involved. See the Liferay Security Advisory CVE-2025-62260 for vendor-confirmed technical details.

Detection Methods for CVE-2025-62260

Indicators of Compromise

• HTTP requests to /o/headless-*/ endpoints with abnormally large pageSize parameters or repeated paginated queries from a single authenticated session.
• Sudden spikes in JVM heap usage, garbage collection pauses, or thread pool saturation on Liferay application servers.
• Database query logs showing repeated large SELECT statements against Liferay object tables originating from Headless API service classes.

Detection Strategies

• Monitor reverse proxy and application access logs for Headless API requests with pageSize values exceeding documented operational norms.
• Correlate authenticated API request rates against per-user baselines to identify abnormal collection enumeration behavior.
• Alert on Liferay application server metrics including heap utilization, response latency, and HTTP 5xx error rates that coincide with Headless API traffic.

Monitoring Recommendations

• Enable verbose logging on Liferay Headless API modules and forward logs to a centralized SIEM for query and retention.
• Configure web application firewall (WAF) rules to inspect and rate-limit requests to /o/headless-*/ paths.
• Track outbound response sizes from Headless endpoints; responses several orders of magnitude larger than the median warrant investigation.

How to Mitigate CVE-2025-62260

Immediate Actions Required

• Apply the security fix referenced in the Liferay Security Advisory CVE-2025-62260 for your Portal or DXP version.
• Audit Headless API user accounts and revoke unnecessary access to reduce the population of users capable of triggering the issue.
• Place rate limits and request-size limits in front of Liferay using a reverse proxy or WAF as a compensating control until patches are applied.

Patch Information

Liferay has published a security advisory for CVE-2025-62260 with remediation guidance for supported Portal and DXP versions. Customers running unsupported versions should upgrade to a supported release that includes the fix. Refer to the Liferay Security Advisory CVE-2025-62260 for version-specific patch availability.

Workarounds

• Enforce maximum pageSize values at the reverse proxy by rewriting or rejecting requests exceeding a safe threshold.
• Apply per-user and per-IP rate limiting to Headless API endpoints to slow enumeration attempts.
• Restrict Headless API access by network segmentation so only trusted internal clients can reach the endpoints.

# Example NGINX rule to cap pageSize on Liferay Headless API requests
location ~ ^/o/headless- {
    if ($arg_pageSize ~* "^[0-9]{4,}$") {
        return 400;
    }
    limit_req zone=headless_api burst=20 nodelay;
    proxy_pass http://liferay_upstream;
}