CVE-2025-3602: High severity Liferay Digital Experience Platform vulnerability

Published Jun 16, 2025
·
Updated

Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries.

Affected Software

58 affected componentsFixes available
maven/com.liferay:com.liferay.portal.vulcan.impl<5.0.103
5.0.103
Liferay Digital Experience Platform>=2023.q3.1<=2023.q3.2
Liferay Digital Experience Platform=7.2-fix_pack_10
Liferay Digital Experience Platform=7.2-fix_pack_11
Liferay Digital Experience Platform=7.2-fix_pack_12
Liferay Digital Experience Platform=7.2-fix_pack_13
Liferay Digital Experience Platform=7.2-fix_pack_14
Liferay Digital Experience Platform=7.2-fix_pack_15
Liferay Digital Experience Platform=7.2-fix_pack_16
Liferay Digital Experience Platform=7.2-fix_pack_17
Liferay Digital Experience Platform=7.2-fix_pack_18
Liferay Digital Experience Platform=7.2-fix_pack_19
Liferay Digital Experience Platform=7.2-fix_pack_20
Liferay Digital Experience Platform=7.2-fix_pack_8
Liferay Digital Experience Platform=7.2-fix_pack_9
Liferay Digital Experience Platform=7.3
Liferay Digital Experience Platform=7.3-fix_pack_1
Liferay Digital Experience Platform=7.3-fix_pack_2
Liferay Digital Experience Platform=7.3-service_pack_1
Liferay Digital Experience Platform=7.3-service_pack_2
Liferay Digital Experience Platform=7.3-service_pack_3
Liferay Digital Experience Platform=7.3-update1
Liferay Digital Experience Platform=7.3-update10
Liferay Digital Experience Platform=7.3-update11
Liferay Digital Experience Platform=7.3-update12
Liferay Digital Experience Platform=7.3-update13
Liferay Digital Experience Platform=7.3-update14
Liferay Digital Experience Platform=7.3-update15
Liferay Digital Experience Platform=7.3-update16
Liferay Digital Experience Platform=7.3-update17
Liferay Digital Experience Platform=7.3-update18
Liferay Digital Experience Platform=7.3-update19
Liferay Digital Experience Platform=7.3-update2
Liferay Digital Experience Platform=7.3-update20
Liferay Digital Experience Platform=7.3-update21
Liferay Digital Experience Platform=7.3-update22
Liferay Digital Experience Platform=7.3-update23
Liferay Digital Experience Platform=7.3-update24
Liferay Digital Experience Platform=7.3-update25
Liferay Digital Experience Platform=7.3-update26
Liferay Digital Experience Platform=7.3-update27
Liferay Digital Experience Platform=7.3-update28
Liferay Digital Experience Platform=7.3-update29
Liferay Digital Experience Platform=7.3-update3
Liferay Digital Experience Platform=7.3-update30
Liferay Digital Experience Platform=7.3-update31
Liferay Digital Experience Platform=7.3-update32
Liferay Digital Experience Platform=7.3-update33
Liferay Digital Experience Platform=7.3-update34
Liferay Digital Experience Platform=7.3-update35
Liferay Digital Experience Platform=7.3-update4
Liferay Digital Experience Platform=7.3-update5
Liferay Digital Experience Platform=7.3-update6
Liferay Digital Experience Platform=7.3-update7
Liferay Digital Experience Platform=7.3-update8
Liferay Digital Experience Platform=7.3-update9
Liferay Digital Experience Platform=7.4
Liferay Liferay Portal>=7.4.0<=7.4.3.97

Event History

Jun 16, 2025
CVE Published
via MITRE·01:50 PM
Data Sourced
via MITRE·01:50 PM
DescriptionWeakness
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:15 PM
Affected Software
Advisory Published
via GitHub·03:32 PM
Data Sourced
via GitHub·03:32 PM
DescriptionWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-3602?

CVE-2025-3602 has been classified as a high severity vulnerability due to its potential to enable denial-of-service attacks.

2

How do I fix CVE-2025-3602?

To fix CVE-2025-3602, upgrade Liferay Portal to version 7.4.4 or later, or apply the appropriate patch provided by Liferay.

3

What versions are affected by CVE-2025-3602?

CVE-2025-3602 affects Liferay Portal versions 7.4.0 through 7.4.3.97 and various versions of Liferay DXP from 2023.Q3.1 through 2023.Q3.2.

4

Is CVE-2025-3602 exploitable remotely?

Yes, CVE-2025-3602 is exploitable remotely, allowing attackers to perform denial-of-service attacks via excessive GraphQL queries.

5

What is the impact of CVE-2025-3602?

The impact of CVE-2025-3602 can lead to service interruption, affecting the availability of the Liferay Portal services due to possible overload.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203