CVE-2026-87721

Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a persistent denial of service (CPU exhaustion and HTTP worker thread pool starvation requiring a server restart) via crafted search queries containing deeply nested parentheses sent to query evaluation endpoints (/changes/?q=, /accounts/?q=, /groups/?query=, /projects/?query=, /Documentation/?q=, /changes/{id}/query?expression=, or SSH gerrit query). Because syntactic predicates in conditionOr and conditionAnd recurse via conditionBase without memoization prior to capability or visibility checks and worker threads do not abort when the client disconnects, a small number of requests (such as 25 requests matching default httpd.maxThreads) can permanently pin all HTTP worker threads. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

• CWE-400
• CWE-407
• CWE-834

• https://issues.gerritcodereview.com/issues/541287630

Published

Sep 24, 2026

Last Modified

Sep 25, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8770A vulnerability was identified in continuedev continue up to…3.3
• CVE-2026-87701Improper neutralization of special elements in output used b…9.6
• CVE-2026-8771A security flaw has been discovered in linlinjava litemall u…7.3
• CVE-2026-87719GitLab has remediated an issue in GitLab EE affecting all ve…9.9
• CVE-2026-8772A weakness has been identified in linlinjava litemall up to …4.7
• CVE-2026-87720Incorrect Authorization (CWE-863) in project name normalizat…7.6
• CVE-2026-87722Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in re…8.7
• CVE-2026-87724Tor before 0.4.9.12 interprets the CC_RESPONSE extension eve…6.5
• CVE-2026-87727a-blog cms Ver. 3.2.33 and earlier contains a path traversal…6.9
• CVE-2026-8773A security vulnerability has been detected in linlinjava lit…4.7
• CVE-2026-87730Rejected reason: this is rejected
• CVE-2026-87732An issue was discovered in the mirage-crypto package before …6.2