CVE-2025-43816
A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2024.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API endpoint.
We have discovered 71 live websites that are affected by CVE-2025-43816.
Affected Software
| Product |  Liferay |
| Category | Content Management System |
| Vulnerable Domains | 71 live websites (2.13% of Liferay install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 16 versions ( 27% of all versions) |
Common Weakness Enumeration
CWE-401 Missing Release of Memory after Effective LifetimeDetails
- Published - Sep 25, 2025
- Updated - Sep 26, 2025
CVE References
CWE References
CWE
Website Distribution by Country
Number of websites using CVE-2025-43816 United States | 9 websites |
 Italy | 13 websites |
 Spain | 10 websites |
 Germany | 9 websites |
 Poland | 7 websites |
 GB | 4 websites |
 Brazil | 3 websites |
 Portugal | 3 websites |
 France | 2 websites |
 Argentina | 1 websites |
Website Distribution by TLD
Number of websites using CVE-2025-43816| .com | 12 websites |
| .it | 10 websites |
| .es | 7 websites |
| .pl | 7 websites |
| .de | 6 websites |
| .org | 5 websites |
| .co.uk | 4 websites |
| .net | 2 websites |
| .be | 1 websites |
| .cz | 1 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redWebsites affected by CVE-2025-43816
Top websites that are affected by CVE-2025-43816. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ****.***.it | Italy | **,*** | |
| *****.**.***.br | Brazil | ***,*** | |
| ***.it | Italy | ***,*** | |
| *****.org |  Singapore | ***,*** | |
| *******.org | Spain | ***,*** | |
| ******.****.***.it | Italy | ***,*** | |
| *****.****.***.it | Italy | ***,*** | |
| **************.de | Germany | ***,*** | |
| ***********.*****.pl | Poland | ***,*** | |
| **.**.***.br | Brazil | ***,*** |
FAQ
CVE-2025-43816 is Missing Release of Memory after Effective Lifetime in Liferay
A total of 71 websites have been identified as vulnerable to CVE-2025-43816, based on global website indexing conducted by WebTechSurvey.
The Liferay is affected by the CVE-2025-43816 vulnerability.
Liferay versions up to and including 7.4.3.119 are vulnerable to CVE-2025-43816.