Volerion logoVolerion
Volerion logoVolerion

Liferay Portal and Liferay DXP Memory Leak Vulnerability in Headless API for StructuredContents Allowing Denial-of-Service

Vulnerability

A memory leak vulnerability has been identified in the headless API for StructuredContents, present in Liferay Portal versions 7.4.0 through 7.4.3.119, older unsupported versions, and Liferay DXP versions 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2024.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92. This vulnerability allows an attacker to cause server unavailability by repeatedly calling the API endpoint, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, leading to server unavailability.

Remediation

Users can upgrade to Liferay Portal 7.4.3.120 or Liferay DXP versions 2024.Q1.6 or 2024.Q2.0 to address this vulnerability.

Added: Sep 25, 2025, 8:21 PM
Updated: Sep 25, 2025, 8:21 PM

Vulnerability Rating

Custom Algorithm
spread
3.1
impact
2.5
exploitability
8.1
remediation
7.7
relevance
0.6
threat
0.0
urgency
2.9
incentive
10.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.