CVE-2026-87721

Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a persistent denial of service (CPU exhaustion and HTTP worker thread pool starvation requiring a server restart) via crafted search queries containing deeply nested parentheses sent to query evaluation endpoints (/changes/?q=, /accounts/?q=, /groups/?query=, /projects/?query=, /Documentation/?q=, /changes/{id}/query?expression=, or SSH gerrit query). Because syntactic predicates in conditionOr and conditionAnd recurse via conditionBase without memoization prior to capability or visibility checks and worker threads do not abort when the client disconnects, a small number of requests (such as 25 requests matching default httpd.maxThreads) can permanently pin all HTTP worker threads. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

• CWE-400
• CWE-407
• CWE-834

• https://issues.gerritcodereview.com/issues/541287630

Published

Sep 24, 2026

Last Modified

Sep 25, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-87715Use after free in Windows Installer allows an authorized att…7
• CVE-2026-87716Heap-based buffer overflow in Windows Storage Spaces Control…7.5
• CVE-2026-87718Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Con…2.3
• CVE-2026-87719GitLab has remediated an issue in GitLab EE affecting all ve…9.9
• CVE-2026-8772A weakness has been identified in linlinjava litemall up to …4.7
• CVE-2026-87720Incorrect Authorization (CWE-863) in project name normalizat…7.6
• CVE-2026-87722Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in re…8.7
• CVE-2026-87723In Google fuse-archive versions prior to 1.24, an attacker w…5.4
• CVE-2026-87724Tor before 0.4.9.12 interprets the CC_RESPONSE extension eve…6.5
• CVE-2026-87726Insufficient API bounds checking in phalFelica in NXP NXPNfc…3.9
• CVE-2026-87727a-blog cms Ver. 3.2.33 and earlier contains a path traversal…6.9
• CVE-2026-8773A security vulnerability has been detected in linlinjava lit…4.7