Denial of Service Vulnerability in Gerrit Code Review by Gerrit

CVE-2026-87722

What is CVE-2026-87722?

A vulnerability in Gerrit Code Review arises from uncontrolled resource consumption via regex search queries and REST API calls. This flaw enables an unauthenticated remote attacker, or an authenticated user (with anonymous read access disabled), to trigger denial of service conditions by executing crafted queries containing extensive repetitions or complex patterns. The underlying issue stems from how user-supplied regular expressions are compiled within an unbounded environment, leading to CPU starvation and JVM heap exhaustion. The vulnerability affects several versions of Gerrit, and remediation is available in updated versions starting with 3.12.10, 3.13.9, and 3.14.3.

References