Skip to content
Heist/ feed
High

Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review

Type: advisorySource: Official CVE List1 source record

Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a persistent denial of service (CPU exhaustion and HTTP worker thread pool starvation requiring a server restart) via crafted search queries containing deeply nested parentheses sent to query evaluation endpoints (/changes/?q=, /accounts/?q=, /groups/?query=, /projects/?query=, /Documentation/?q=, /changes/{id}/query?expression=, or SSH gerrit query). Because syntactic predicates in conditionOr and conditionAnd recurse via conditionBase without memoization prior to capability or visibility checks and worker threads do not abort when the client disconnects, a small number of requests (such as 25 requests matching default httpd.maxThreads) can permanently pin all HTTP worker threads. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

Announced Source revision 1
Original source ↗

CVE-2026-87721

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-87721

Gerrit

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Gerrit",
    "product": "Gerrit",
    "versions": [
      {
        "status": "affected",
        "version": "2.0.19",
        "lessThan": "3.12.10",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "3.13.0",
        "lessThan": "3.13.9",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "3.14.0",
        "lessThan": "3.14.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-87721

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#2187 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement