Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-87721— Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review

Quick assessment

Affected
Gerrit Gerrit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

不受控的资源消耗（CWE-400 / CWE-407） 在 Gerrit Code Review 版本 2.0.19 至 3.12.9、3.13.0 至 3.13.8，以及 3.14.0 至 3.14.2 中，ANTLR 3 搜索查询解析器（QueryParser / Query.g）存在不受控的资源消耗漏洞。未经身份验证的远程攻击者（或在禁用匿名读取访问权限的情况下，任何已认证用户）可以通过向查询评估端点（如 、 、 、 、 、 ，或通过 SSH 发起的 gerrit 查询）发送包含深层嵌套括号的构造性搜索查询，

CVSS 8.7 · High EPSS 0.32% · P25

Affected Version Matrix 3

VendorProduct Version RangeStatus
Gerrit Gerrit 2.0.19< 3.12.10 affected
3.13.0< 3.13.9 affected
3.14.0< 3.14.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-87721

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review
Source: CVE Program / CVE List V5
Vulnerability Description
Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a persistent denial of service (CPU exhaustion and HTTP worker thread pool starvation requiring a server restart) via crafted search queries containing deeply nested parentheses sent to query evaluation endpoints (/changes/?q=, /accounts/?q=, /groups/?query=, /projects/?query=, /Documentation/?q=, /changes/{id}/query?expression=, or SSH gerrit query). Because syntactic predicates in conditionOr and conditionAnd recurse via conditionBase without memoization prior to capability or visibility checks and worker threads do not abort when the client disconnects, a small number of requests (such as 25 requests matching default httpd.maxThreads) can permanently pin all HTTP worker threads. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Gerrit Gerrit 2.0.19 ~ 3.12.10 -

II. Public POCs for CVE-2026-87721

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-87721

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-87721 (1)

Same Patch Batch · Gerrit · 2026-09-24 · 3 CVEs total

CVE-2026-87722 8.7 HIGH Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter En
CVE-2026-87720 7.6 HIGH Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerr

IV. Related Vulnerabilities

Same product: Gerrit
Same vendor: Gerrit
Same weakness: CWE-400