Read the docs
TI-2026-59882 Aliases CVE-2026-87721GHSA-q3rp-qmhw-57f7

Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review

Priority HIGH 77CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a persistent denial of service (CPU exhaustion and HTTP worker thread pool starvation requiring a server restart) via crafted search queries containing deeply nested parentheses sent to query evaluation endpoints (/changes/?q=, /accounts/?q=, /groups/?query=, /projects/?query=, /Documentation/?q=, /changes/{id}/query?expression=, or SSH gerrit query). Because syntactic predicates in conditionOr and conditionAnd recurse via conditionBase without memoization prior to capability or visibility checks and worker threads do not abort when the client disconnects, a small number of requests (such as 25 requests matching default httpd.maxThreads) can permanently pin all HTTP worker threads. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00322 25th percentileScored 2026-11-07
Fix Fixed Gerrit (Gerrit): 3.12.10, 3.13.9, 3.14.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleGerrit2.0.19 to before 3.12.10; 3.13.0 to before 3.13.9; 3.14.0 to before 3.14.33.12.10, 3.13.9, 3.14.3Patch availableCNA
  • Gerrit VendorGoogle Affected 2.0.19 to before 3.12.10; 3.13.0 to before 3.13.9; 3.14.0 to before 3.14.3 Fixed in 3.12.10, 3.13.9, 3.14.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:google:gerrit:*:*:*:*:*:*:*:*——Google
  • cpe:2.3:a:google:gerrit:*:*:*:*:*:*:*:* Versions — — ·Google

Remediation

  • Fix · CNA Gerrit (Gerrit) Fixed in 3.12.10, 3.13.9, 3.14.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Gerrit 3.12.10, 3.13.9, 3.14.3

    3 records Highest priority Priority HIGH 3 HIGH

    Other records, highest priority first

    • TI-2026-59883 Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code ReviewPriority HIGH 77
    • TI-2026-59881 Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code ReviewPriority HIGH 68
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-87721
  2. 2026-10-03 Alias added: GHSA-q3rp-qmhw-57f7

References

Other 1

  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
See all 17247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences