CVE-2023-26112

What it actually does

ReDoS condition in the validate function triggered by the regex (.+?)\((.*)\) when processing crafted input values.

Why it matters to the business

An attacker who can influence a server-side configuration file can cause the application process to consume excessive CPU and become unresponsive, disrupting service availability.

How an attack unfolds

An attacker supplies a malicious string matching the vulnerable regex pattern into a configuration file that a developer places on the server; when the configobj validate function processes that file the regex engine enters catastrophic backtracking and the process hangs until timeout or manual intervention.

How to fix it

Upgrade com.liferay.portal/release.portal.bom to version 7.4.3.53 or later; if an upgrade is not immediately possible, remove or sanitize any untrusted values from configuration files before they reach the validate function.

How to confirm the fix worked

Confirm the installed package version is 7.4.3.53 or newer; test the validate function with known benign and previously crashing inputs in a non-production environment to verify the regex no longer hangs.

Typical attack path

1. Identify or obtain write access to a server-side configuration file consumed by configobj
2. Insert a crafted value that triggers the (.+?)\((.*)\) regex
3. Trigger application startup or configuration reload that calls validate
4. Observe sustained high CPU and service unavailability

How to detect it

Monitor process CPU usage and request latency spikes immediately after configuration reloads or application restarts; inspect server configuration files for unusual strings containing nested parentheses or long repetitive patterns.

What your security team should do

• Apply the 7.4.3.53 update to the affected BOM within the next maintenance window
• Audit all server-side configuration files for values that could reach the vulnerable regex
• Add the package to the dependency monitoring policy to prevent future vulnerable versions
• Review application startup and configuration reload paths for excessive CPU alerts