{"action":"Upgrade com.liferay:com.liferay.portal.vulcan.api to 40.2.0 or later.","affected":[{"fixed":"40.2.0","introduced":"8.0.2"}],"component":"com.liferay:com.liferay.portal.vulcan.api","cve_ids":["CVE-2025-43796"],"ecosystem":"Maven","epss":0.00377,"exploited":false,"fixed_versions":["40.2.0"],"ghsa_id":"GHSA-f3hf-r62c-mfrj","id":"tcs_01M5N8TV352GQDQ0R8H8YC4F33","modified_at":"2025-09-15T14:12:20.158555Z","published_at":"2025-09-12T21:32:14Z","references":["https://osv.dev/vulnerability/GHSA-f3hf-r62c-mfrj","https://nvd.nist.gov/vuln/detail/CVE-2025-43796","https://github.com/liferay/liferay-portal/commit/2e4adf041e31f3474a14c29b7c135693f6529400","https://github.com/liferay/liferay-portal/commit/2f74f23982fb03238f9b4ae145c33a9c1084f07e","https://github.com/liferay/liferay-portal/commit/3780804b0d8f4f14bfca470a3e2e662bc6cef588","https://github.com/liferay/liferay-portal/commit/8344aec3bebcd2ca409794523d5db5be6047c3dd","https://github.com/liferay/liferay-portal/commit/83e77963499d4d3e7cc82cc48e63c992f6f29a6d","https://github.com/liferay/liferay-portal/commit/8dda4adc0e9e7b6f82d4b3959592cad61640309b","https://github.com/liferay/liferay-portal","https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43796","http://github.com/liferay/liferay-portal/commit/8f7eb98e05a5ea6961346ecc21fd73e4b46bba99"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-f3hf-r62c-mfrj","url":"https://osv.dev/vulnerability/GHSA-f3hf-r62c-mfrj"},{"source":"nvd","source_id":"CVE-2025-43796","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43796"}],"summary":"Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack"}