Cyber Resilience

CVE-2025-43764

Medium

Published: 23 August 2025

Published
23 August 2025
Modified
12 December 2025
KEV Added
Patch
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0010 27.4th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-43764 is a medium-severity Inefficient Regular Expression Complexity (CWE-1333) vulnerability in Liferay Digital Experience Platform. Its CVSS base score is 6.9 (Medium).

Operationally, ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.1, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4…

more

GA through update 92, which allows authenticated users with permissions to update Kaleo Workflows to enter a malicious Regex pattern causing their browser to hang for a very long time.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

liferay
digital experience platform
7.4 · 2024.Q1.1 — 2024.Q1.20 · 2024.q2.0 — 2024.q2.13 · 2024.q3.1 — 2024.q3.13
liferay
liferay portal
7.4.0 — 7.4.3.132

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References