Cyber Resilience

CVE-2025-43816

Medium

Published: 25 September 2025

Published
25 September 2025
Modified
15 December 2025
KEV Added
—
Patch
—
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0014 34.1th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-43816 is a medium-severity Missing Release of Memory after Effective Lifetime (CWE-401) vulnerability in Liferay Digital Experience Platform. Its CVSS base score is 6.9 (Medium).

Operationally, ranked at the 34.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2024.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions…

more

allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API endpoint.

CWE(s)
CWE-401

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

liferay
digital experience platform
7.4 · ≤ 7.4 · 2023.Q3.1 — 2023.Q3.10 · 2023.q4.0 — 2023.q4.10
liferay
liferay portal
≤ 7.4.3.120

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References