Liferay Portal CVE-2025-62254

Requires that the Liferay ComboServlet (a standard, default-enabled portal component serving combined JS/CSS resources) be network-reachable by the attacker; exploitation is performed by manipulating the URL query string to request an unbounded number or size of files. No authentication, user interaction, or non-default configuration is needed (PR:N/UI:N). The principal limiting factor is impact scope: the flaw yields only partial availability degradation (VA:L) via oversized responses rather than confidentiality/integrity loss or a guaranteed full crash, and its practical effect depends on server capacity and any upstream rate-limiting/WAF/response-size controls.

All signals converge on a moderate, availability-only issue rather than a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability, but impact is limited to VA:L (partial availability) with no confidentiality or integrity effect, yielding a medium 6.9 base score. EPSS is low at 0.55% (45th percentile), there is no CISA KEV listing and no public exploit identified, so there is no evidence of widespread or automated exploitation. The net picture is a genuine but low-urgency DoS: easy to reach but causing degraded availability rather than full compromise or outage. Note a labeling tension: the CWE is CWE-22 (Path Traversal) and a 'Path Traversal' tag is present, yet the description describes only uncontrolled resource amplification (unbounded file combination) leading to DoS, with no directory-traversal behavior stated - treat the DoS characterization as authoritative and verify the path-traversal angle with Liferay.

A remote, unauthenticated attacker sends requests to the Liferay ComboServlet whose URL query string references a large number and/or size of files to be combined into a single response. Because the servlet does not cap the count or total size, the server builds very large responses, consuming bandwidth, memory, and CPU and degrading availability for legitimate users. No public exploit code is identified at time of analysis, but the technique is trivial to script given the low attack complexity.