CVE-2022-42124: Inefficient Regular Expression Complexity in Liferay Portal

November 15, 2022 (updated September 5, 2025)

ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected into the ’name’ field of a layout prototype.

References

github.com/advisories/GHSA-vjj4-qwcm-552h
issues.liferay.com/browse/LPE-17435
issues.liferay.com/browse/LPE-17535
nvd.nist.gov/vuln/detail/CVE-2022-42124
portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42124

Code Behaviors & Features

Detect and mitigate CVE-2022-42124 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →