CVE-2025-43772CWE-400denial-of-service

CVE-2025-43772

published September 4, 2025

CVSS
7.1
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict the saving of request parameters in the portlet session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP request.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00517 · 43.1th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2025-09-04T14:42Z
References (1)
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43772 · [email protected]
EPSS history
Timeline
  • 04 SEP 01:57Z
    Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict…
    cvelistv5