8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-3602

CVE-2025-3602: Liferay Portal does not limit the depth of a GraphQL queries

Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-3602

CVE-2025-3602:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.portal.vulcan.impl	maven	< 5.0.103	5.0.103

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-3602, concerns the lack of GraphQL query depth limitation in Liferay Portal, which could lead to Denial of Service (DoS) attacks. The provided commit 6c6dad38c9c891ad58cdee9deb2e35432d7e8816 introduces a fix for this issue.

The primary change occurs in the GraphQLServletExtender.java file, specifically within the _createServlet method. This method is responsible for setting up the GraphQL servlet, including its query execution mechanism (GraphQLQueryInvoker).

Before the patch, the GraphQLQueryInvoker was initialized without any instrumentation to limit the depth of incoming GraphQL queries. The patch modifies the _createServlet method to include MaxQueryDepthInstrumentation (a new class added by the patch) when building the GraphQLQueryInvoker. This new instrumentation is responsible for enforcing a configurable query depth limit, obtained via _getMaxQueryDepthInstrumentation which reads from HeadlessAPICompanyConfiguration.

Therefore, the _createServlet method, in its pre-patch state, was the point where the vulnerable configuration (i.e., lack of depth limiting) was established. When a GraphQL query is processed, it goes through the servlet configured by this method. If an attacker sends an overly complex (deeply nested) query, the unconstrained execution would lead to excessive resource consumption, causing a DoS. The _createServlet function is thus identified as the key function that, by its previous definition, allowed the vulnerable behavior.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.