Maven/com.liferay:com.liferay.portal.vulcan.api CVE-2025-43796: high 7.5, EPSS 0.38%
Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack
Action: Upgrade com.liferay:com.liferay.portal.vulcan.api to 40.2.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.2 | 40.2.0 | - |
Fixed versions
| 40.2.0 |
Sources
- osv: GHSA-f3hf-r62c-mfrj
- nvd: CVE-2025-43796
- https://github.com/liferay/liferay-portal/commit/2e4adf041e31f3474a14c29b7c135693f6529400
- https://github.com/liferay/liferay-portal/commit/2f74f23982fb03238f9b4ae145c33a9c1084f07e
- https://github.com/liferay/liferay-portal/commit/3780804b0d8f4f14bfca470a3e2e662bc6cef588
- https://github.com/liferay/liferay-portal/commit/8344aec3bebcd2ca409794523d5db5be6047c3dd
- https://github.com/liferay/liferay-portal/commit/83e77963499d4d3e7cc82cc48e63c992f6f29a6d
- https://github.com/liferay/liferay-portal/commit/8dda4adc0e9e7b6f82d4b3959592cad61640309b
- https://github.com/liferay/liferay-portal
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43796
- http://github.com/liferay/liferay-portal/commit/8f7eb98e05a5ea6961346ecc21fd73e4b46bba99
CVE-2025-43796 · published · modified · JSON