GHSA-q95h-87j6-273x
High · 7.5CVSS
7.5
EPSS
—
Published
Oct 24, 2025
CISA due date
—
The record
Liferay Portal ComboServlet denial of service via large file combination
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.liferay.portal:com.liferay.portal.impl | 0 | 97.0.0 |
Related vulnerabilities
- CVE-2025-62254 Liferay Portal ComboServlet denial of service via large file combination Same vulnerability
- GHSA-6533-fhr2-f38h Liferay Portal and DXP use an incorrect cache-control header Also affects com.liferay.portal:com.liferay.portal.impl
- CVE-2025-62276 Liferay Portal and DXP use an incorrect cache-control header Also affects com.liferay.portal:com.liferay.portal.impl
- GHSA-xcj6-xpjg-c4xr Liferay Portal Stores Password Reset Tokens in Plain Text Also affects com.liferay.portal:com.liferay.portal.impl
- CVE-2025-62261 Liferay Portal Stores Password Reset Tokens in Plain Text Also affects com.liferay.portal:com.liferay.portal.impl
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22
- CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote… CWE-22