CVE-2026-87722

Received Received - Intake

Uncontrolled Resource Consumption in Gerrit Code Review

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: Google Inc.

Description

Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling predicates) and REST regex filter endpoints (RegexListSearcher /projects/?r= and RefFilter /projects/{project}/branches/?r=) in Gerrit Code Review versions 2.1.6 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a denial of service (CPU starvation and JVM heap exhaustion / OutOfMemoryError) via crafted search queries or REST API requests containing regular expressions with large counted repetitions or exponential DFA determinization patterns. Because the user-supplied regular expression is compiled into an unbounded dk.brics.automaton instance (new RegExp(re).toAutomaton()) on the request thread prior to index evaluation or access control visibility filtering, trivial queries can exhaust JVM heap or pin request threads regardless of heap size. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-87722

Affected Vendors & Products

Vendor	Product	Version / Range
gerrit		code_review From 2.1.6 (inc) to 3.12.9 (inc)
gerrit		code_review From 3.13.0 (inc) to 3.13.8 (inc)
gerrit		code_review From 3.14.0 (inc) to 3.14.2 (inc)
gerrit		code_review 3.12.10
gerrit		code_review 3.13.9
gerrit		code_review 3.14.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled resource consumption issue in Gerrit Code Review versions 2.1.6 through 3.14.2. It involves crafted regular expressions in search queries or REST API requests that cause CPU starvation and JVM heap exhaustion. The problem occurs because user-supplied regex patterns are compiled into unbounded automaton instances before processing, leading to trivial queries consuming excessive resources.

Detection Guidance

This vulnerability can be detected by monitoring for unusual CPU or memory usage spikes during regex-based search queries or REST API requests. Check Gerrit logs for OutOfMemoryError exceptions or slow request processing. Use system monitoring tools like top, htop, or jstack to identify threads stuck in regex compilation.

Impact Analysis

An unauthenticated remote attacker or authenticated user (if anonymous read access is disabled) can exploit this to cause denial of service by crashing the Gerrit server through CPU overload or OutOfMemoryError. This disrupts access to the code review system and may lead to service unavailability.

Mitigation Strategies

Upgrade Gerrit to versions 3.12.10, 3.13.9, or 3.14.3 or later. If immediate upgrade is not possible, restrict access to regex search endpoints or disable anonymous read access. Monitor for suspicious queries and implement rate limiting on search requests.

Hi! I’m here to help you understand CVE-2026-87722. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70