N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43796

CVE-2025-43796: Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack

Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing queries that return a large number of objects.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43796

CVE-2025-43796:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.portal.vulcan.api	maven	>= 8.0.2, < 40.2.0	40.2.0
com.liferay:com.liferay.portal.vulcan.impl	maven	>= 5.0.7, < 5.0.105	5.0.105

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of server-side enforcement of pagination size limits for GraphQL queries, allowing a remote attacker to trigger a denial-of-service by requesting an excessive number of objects. The analysis of the provided patches reveals that the core of the vulnerability was in the GraphQL data processing layer within Liferay Portal's Vulcan module.

The root cause was that GraphQL data fetching processors directly used user-provided pageSize arguments without validating them against a maximum allowed limit. This allowed for resource exhaustion attacks.

The key vulnerable functions identified are:

com.liferay.portal.vulcan.internal.graphql.data.processor.GraphQLDTOContributorDataFetchingProcessor.list: This function directly used the pageSize from the request to create a Pagination object, completely bypassing any size limitation.
com.liferay.portal.vulcan.internal.graphql.data.processor.LiferayMethodDataFetchingProcessor.process: This function, responsible for processing GraphQL method calls, also failed to enforce a cap on the pageSize argument, passing potentially huge values to downstream service methods.

The mitigation strategy involved introducing a centralized PaginationProvider (com.liferay.portal.vulcan.pagination.provider.PaginationProvider). This provider is responsible for retrieving a company-specific page size limit (pageSizeLimit from HeadlessAPICompanyConfiguration) and ensuring that any requested page size does not exceed this limit. The vulnerable functions were then refactored to use this new provider, which sanitizes the pagination parameters before they are used to fetch data. During an exploit, a profiler would show one of these vulnerable functions being called, leading to long execution times and high memory usage in subsequent data access operations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.