GHSA-6533-fhr2-f38h
Medium · 5.5CVSS
5.5
EPSS
—
Published
Nov 1, 2025
CISA due date
—
The record
Liferay Portal and DXP use an incorrect cache-control header
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.liferay.portal:com.liferay.portal.impl | 0 | 69.1.0 |
| Maven | com.liferay:com.liferay.adaptive.media.web | 0 | 5.0.52 |
Related vulnerabilities
- CVE-2025-62276 Liferay Portal and DXP use an incorrect cache-control header Same vulnerability
- GHSA-xcj6-xpjg-c4xr Liferay Portal Stores Password Reset Tokens in Plain Text Also affects com.liferay.portal:com.liferay.portal.impl
- CVE-2025-62261 Liferay Portal Stores Password Reset Tokens in Plain Text Also affects com.liferay.portal:com.liferay.portal.impl
- GHSA-q95h-87j6-273x Liferay Portal ComboServlet denial of service via large file combination Also affects com.liferay.portal:com.liferay.portal.impl
- CVE-2025-62254 Liferay Portal ComboServlet denial of service via large file combination Also affects com.liferay.portal:com.liferay.portal.impl
- CVE-2026-96369 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform… CWE-525
- CVE-2026-87940 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key… CWE-525
- CVE-2026-13697 undici's cache interceptor mishandles malformed Cache-Control private directives. CWE-525