CVE-2025-3526

State: Published
Severity: 8.7 High
Published: Jun 16, 2025
Updated: Jun 16, 2025
Reserved: Apr 11, 2025

Description

SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does not restrict the saving of request parameters in the HTTP session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP requests.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	Liferay

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
PortalLiferay	7.0.0 through 7.4.3.21Affected
DXPLiferay	6.2.0 through portal-173Affected 7.0.10 through de-102Affected 7.1.10 through dxp-28Affected 7.2.10 through dxp-20Affected 7.3.10 through 7.3.10-u25Affected 7.4.13 through 7.4.13-u9Affected

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3526

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.