CVE-2026-87721 PUBLISHED

Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review

Assigner: Google
Reserved: 09.09.2026 Published: 24.09.2026 Updated: 24.09.2026

Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a persistent denial of service (CPU exhaustion and HTTP worker thread pool starvation requiring a server restart) via crafted search queries containing deeply nested parentheses sent to query evaluation endpoints (/changes/?q=, /accounts/?q=, /groups/?query=, /projects/?query=, /Documentation/?q=, /changes/{id}/query?expression=, or SSH gerrit query). Because syntactic predicates in conditionOr and conditionAnd recurse via conditionBase without memoization prior to capability or visibility checks and worker threads do not abort when the client disconnects, a small number of requests (such as 25 requests matching default httpd.maxThreads) can permanently pin all HTTP worker threads. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.7

Product Status

Vendor Gerrit
Product Gerrit
Versions Default: unaffected
  • affected from 2.0.19 to 3.12.10 (excl.)
  • affected from 3.13.0 to 3.13.9 (excl.)
  • affected from 3.14.0 to 3.14.3 (excl.)

Credits

  • Amin Alemi finder

References

Problem Types

  • CWE-400 Uncontrolled Resource Consumption CWE
  • CWE-407 Inefficient Algorithmic Complexity CWE
  • CWE-834 Excessive Iteration CWE

Impacts

  • CAPEC-230 Exhaustion of Technical Resources
  • CAPEC-488 HTTP Flood to Exhaust Server Resources
  • CAPEC-147 Excessive Allocation of Resources Due to Flawed Design