What is GHSA-hrqm-qpw9-w8rv?

GHSA-hrqm-qpw9-w8rv is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal and DXP vulnerable to a memory leak

Which CVE IDs does GHSA-hrqm-qpw9-w8rv cover?

GHSA-hrqm-qpw9-w8rv covers the following CVE IDs: CVE-2025-43816. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-hrqm-qpw9-w8rv?

GHSA-hrqm-qpw9-w8rv affects 1 product, including: maven/com.liferay:com.liferay.portal.vulcan.impl:\u003c 5.0.115.

GHSA-hrqm-qpw9-w8rvMedium

Liferay Portal and DXP vulnerable to a memory leak

Vendor

GitHub Security Advisories

Published

September 25, 2025

Last Modified

December 16, 2025

🔗 CVE IDs covered (1)

CVE-2025-43816 →

📋 Description

A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2024.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API endpoint.

🎯 Affected products1

maven/com.liferay:com.liferay.portal.vulcan.impl:< 5.0.115

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-43816
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43816
https://liferay.atlassian.net/browse/LPE-18005
https://github.com/advisories/GHSA-hrqm-qpw9-w8rv