CVE-2025-62254
unknown
CVSS v3
—
CVSS v2
—
VIR risk
—
Description
Liferay Portal ComboServlet denial of service via large file combination
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Maven | com.liferay.portal:com.liferay.portal.impl | <97.0.0 | 97.0.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-62254
- https://github.com/liferay/liferay-portal/commit/45e1a3a757bc38f7b9f8034909e90f1a56f160a5
- https://github.com/liferay/liferay-portal/commit/8328aaf7c6ebb3f76c7982256e028caeb48fb664
- https://github.com/liferay/liferay-portal/commit/85d63e9d6e47e11074046cc4459d3b1ab3370536
- https://github.com/liferay/liferay-portal/commit/def502837297d155ec2fd61044288e75230dd235
- https://github.com/liferay/liferay-portal
- https://liferay.atlassian.net/browse/LPE-17867
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62254
Verify integrity in audit chain (admin only). AS-IS.