CVE-2025-62254: Liferay Portal ComboServlet denial of service via large file combination

The vulnerability description clearly points to the ComboServlet as the source of a denial-of-service vulnerability due to its failure to limit the number and size of files it combines. The provided commit patches all modify the com.liferay.portal.servlet.ComboServlet.java file, specifically within the doService method. The series of commits shows the evolution of a fix: first, introducing a configurable limit (combo.max.files), and then refining the logic to enforce this limit early in the request processing cycle within the doService method. The core of the vulnerability is the absence of a check on the number of requested files, which is precisely what the patches add. Therefore, the doService method is the single, clear point of vulnerability that would be exercised during an exploit.