CVE-2025-3526
Liferay Portal SessionClicks does not restrict the saving of request parameters in the HTTP session
EPSS 0.36%
Description
SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does not restrict the saving of request parameters in the HTTP session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP requests.
How to fix CVE-2025-3526
To remediate CVE-2025-3526, upgrade the affected package to a fixed version below.
- Maven/com.liferay.portal:com.liferay.portal.kernel—upgrade to 38.0.0 or later
Is CVE-2025-3526 being exploited?
Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 38.0.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |