Read the docs
TI-2026-59883 Aliases CVE-2026-87722GHSA-qgc5-8q25-ffxc

Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code Review

Priority HIGH 77CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-1333.

Summary

Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling predicates) and REST regex filter endpoints (RegexListSearcher /projects/?r= and RefFilter /projects/{project}/branches/?r=) in Gerrit Code Review versions 2.1.6 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a denial of service (CPU starvation and JVM heap exhaustion / OutOfMemoryError) via crafted search queries or REST API requests containing regular expressions with large counted repetitions or exponential DFA determinization patterns. Because the user-supplied regular expression is compiled into an unbounded dk.brics.automaton instance (new RegExp(re).toAutomaton()) on the request thread prior to index evaluation or access control visibility filtering, trivial queries can exhaust JVM heap or pin request threads regardless of heap size. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00322 25th percentileScored 2026-11-07
Fix Fixed Gerrit (Gerrit): 3.12.10, 3.13.9, 3.14.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleGerrit2.1.6 to before 3.12.10; 3.13.0 to before 3.13.9; 3.14.0 to before 3.14.33.12.10, 3.13.9, 3.14.3Patch availableCNA
  • Gerrit VendorGoogle Affected 2.1.6 to before 3.12.10; 3.13.0 to before 3.13.9; 3.14.0 to before 3.14.3 Fixed in 3.12.10, 3.13.9, 3.14.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:google:gerrit:*:*:*:*:*:*:*:*——Google
  • cpe:2.3:a:google:gerrit:*:*:*:*:*:*:*:* Versions — — ·Google

Remediation

  • Fix · CNA Gerrit (Gerrit) Fixed in 3.12.10, 3.13.9, 3.14.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Gerrit 3.12.10, 3.13.9, 3.14.3

    3 records Highest priority Priority HIGH 3 HIGH

    Other records, highest priority first

    • TI-2026-59882 Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code ReviewPriority HIGH 77
    • TI-2026-59881 Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code ReviewPriority HIGH 68
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-87722
  2. 2026-10-03 Alias added: GHSA-qgc5-8q25-ffxc

References

Other 1

  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
See all 17247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences