Liferay Portal ComboServlet Denial of Service via large file combination

The primary impact of CVE-2025-62254 is a denial of service. A successful exploit can render the Liferay Portal or DXP instance unresponsive, preventing legitimate users from accessing the platform. The attacker can achieve this by manipulating the URL query string to request an excessive number of files or files of unusually large sizes to be combined by the ComboServlet. This forces the server to expend significant resources in generating the response, potentially overwhelming it and leading to a crash or prolonged downtime. The blast radius extends to all users attempting to access the affected Liferay instance, disrupting business operations and potentially impacting critical services.

Organizations running Liferay Portal or Liferay DXP in production environments are at risk. Specifically, deployments using older, unsupported versions or those that have not applied recent updates are particularly vulnerable. Shared hosting environments where multiple tenants share the same Liferay instance may also be affected, as an attacker could potentially exploit the vulnerability to impact other tenants.

• linux / server: Monitor Liferay Portal logs for unusual activity related to the ComboServlet. Look for requests with extremely long URLs or large file sizes. Use journalctl -u liferay to filter for relevant log entries.

journalctl -u liferay | grep "ComboServlet" | grep -i "large file"

• generic web: Use curl to test the ComboServlet endpoint with a crafted URL containing a large number of files or a very large file. Monitor server resource usage (CPU, memory) during the test.

curl 'http://your-liferay-portal/alfresco/service/api/combo?client=portal&c=combo&comboType=file&file=file1.txt,file2.txt,file3.txt,...' -v

1. 2025-10-24Disclosure

   disclosure

1. Reserviert2025-10-09
2. Veröffentlicht2025-10-24
3. Geändert2025-11-15
4. EPSS aktualisiert2026-03-23

The recommended mitigation for CVE-2025-62254 is to upgrade to Liferay Portal 97.0.0 or later, or the corresponding fixed version of Liferay DXP. If immediate upgrading is not feasible, consider implementing temporary workarounds. These may include configuring a Web Application Firewall (WAF) to filter requests with excessively long or complex URL query strings. Additionally, adjusting the server's resource limits (e.g., maximum request size, memory allocation) might help mitigate the impact, though this is not a complete solution. Monitor ComboServlet logs for unusual activity, such as a sudden increase in requests for large files. After upgrading, confirm the fix by attempting to trigger the vulnerability with a crafted URL and verifying that the server does not crash or become unresponsive.