CVE-2026-87721

Received Received - Intake

Uncontrolled Resource Consumption in Gerrit Code Review

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: Google Inc.

Description

Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a persistent denial of service (CPU exhaustion and HTTP worker thread pool starvation requiring a server restart) via crafted search queries containing deeply nested parentheses sent to query evaluation endpoints (/changes/?q=, /accounts/?q=, /groups/?query=, /projects/?query=, /Documentation/?q=, /changes/{id}/query?expression=, or SSH gerrit query). Because syntactic predicates in conditionOr and conditionAnd recurse via conditionBase without memoization prior to capability or visibility checks and worker threads do not abort when the client disconnects, a small number of requests (such as 25 requests matching default httpd.maxThreads) can permanently pin all HTTP worker threads. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-87721

Affected Vendors & Products

Vendor	Product	Version / Range
google	gerrit_code_review	*
google	gerrit_code_review	From 2.0.19 (inc) to 3.12.10 (exc)
google	gerrit_code_review	From 3.12.10 (inc) to 3.13.9 (exc)
google	gerrit_code_review	From 3.13.9 (inc) to 3.14.3 (exc)
google	gerrit_code_review	From 3.14.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CWE-834	The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled resource consumption issue in Gerrit Code Review's ANTLR 3 search query parser. It allows unauthenticated remote attackers or authenticated users to cause persistent denial of service by sending crafted search queries with deeply nested parentheses. This exhausts CPU resources and starves HTTP worker threads, requiring a server restart to recover.

Detection Guidance

Detect this vulnerability by monitoring HTTP worker thread pool exhaustion and CPU spikes during search queries. Check Gerrit logs for excessive nested parentheses in queries to endpoints like /changes/?q= or /projects/?query=. Use system monitoring tools like top, htop, or netstat to observe CPU usage and thread counts.

Impact Analysis

The vulnerability can cause your Gerrit Code Review server to become unresponsive or crash due to CPU exhaustion and thread starvation. This disrupts access to the system for all users, potentially leading to downtime and loss of productivity.

Mitigation Strategies

Upgrade Gerrit Code Review to versions 3.12.10, 3.13.9, or 3.14.3 or later. If upgrading is not immediately possible, restrict access to query endpoints, limit query complexity, or implement rate limiting to prevent excessive resource consumption.

Hi! I’m here to help you understand CVE-2026-87721. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70