CVE-2026-87722

Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling predicates) and REST regex filter endpoints (RegexListSearcher /projects/?r= and RefFilter /projects/{project}/branches/?r=) in Gerrit Code Review versions 2.1.6 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a denial of service (CPU starvation and JVM heap exhaustion / OutOfMemoryError) via crafted search queries or REST API requests containing regular expressions with large counted repetitions or exponential DFA determinization patterns. Because the user-supplied regular expression is compiled into an unbounded dk.brics.automaton instance (new RegExp(re).toAutomaton()) on the request thread prior to index evaluation or access control visibility filtering, trivial queries can exhaust JVM heap or pin request threads regardless of heap size. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

• CWE-400
• CWE-1333

• https://issues.gerritcodereview.com/issues/540877705

Published

Sep 24, 2026

Last Modified

Sep 25, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-87701Improper neutralization of special elements in output used b…9.6
• CVE-2026-8771A security flaw has been discovered in linlinjava litemall u…7.3
• CVE-2026-87719GitLab has remediated an issue in GitLab EE affecting all ve…9.9
• CVE-2026-8772A weakness has been identified in linlinjava litemall up to …4.7
• CVE-2026-87720Incorrect Authorization (CWE-863) in project name normalizat…7.6
• CVE-2026-87721Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the…8.7
• CVE-2026-87724Tor before 0.4.9.12 interprets the CC_RESPONSE extension eve…6.5
• CVE-2026-87727a-blog cms Ver. 3.2.33 and earlier contains a path traversal…6.9
• CVE-2026-8773A security vulnerability has been detected in linlinjava lit…4.7
• CVE-2026-87730Rejected reason: this is rejected
• CVE-2026-87732An issue was discovered in the mirage-crypto package before …6.2
• CVE-2026-87733An issue was discovered in the mirage-crypto-ec function bef…6.2