Uncontrolled Resource Consumption in Gerrit Code Review by Gerrit

CVE-2026-87721

What is CVE-2026-87721?

The ANTLR 3 search query parser in Gerrit Code Review versions up to 3.14.2 is susceptible to Uncontrolled Resource Consumption. This vulnerability allows unauthorized remote attackers or certain authenticated users to trigger a denial of service through specially crafted search queries. These queries, which can include deeply nested parentheses, can exhaust CPU resources and starve the HTTP worker thread pool, necessitating a server restart. The issue arises due to a recursive lack of memoization in the query parser, which fails to manage thread responsiveness during client disconnections. The vulnerability is mitigated in subsequent Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

References