CVE-2026-87721: Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review
Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a persistent denial of service (CPU exhaustion and HTTP worker thread pool starvation requiring a server restart) via crafted search queries containing deeply nested parentheses sent to query evaluation endpoints (/changes/?q=, /accounts/?q=, /groups/?query=, /projects/?query=, /Documentation/?q=, /changes/{id}/query?expression=, or SSH gerrit query). Because syntactic predicates in conditionOr and conditionAnd recurse via conditionBase without memoization prior to capability or visibility checks and worker threads do not abort when the client disconnects, a small number of requests (such as 25 requests matching default httpd.maxThreads) can permanently pin all HTTP worker threads. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gerrit Code Reviewto a version that resolves this vulnerability.Fixed in 3.12.10 - Upgrade
Upgrade
Gerrit Code Reviewto a version that resolves this vulnerability.Fixed in 3.13.9 - Upgrade
Upgrade
Gerrit Code Reviewto a version that resolves this vulnerability.Fixed in 3.14.3
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated attack?
Deployments with anonymous read access enabled can be attacked remotely without authentication through the affected HTTP query endpoints. If anonymous read access is disabled, an authenticated user can still exploit the issue; the SSH gerrit query interface is also listed as an affected vector.
What does an attacker need to send to trigger the denial of service?
The attacker must submit crafted search queries containing deeply nested parentheses to a query evaluation endpoint, such as /changes/?q=, /accounts/?q=, /groups/?query=, or /projects/?query=. The vulnerable parser can consume CPU through exponential backtracking and pin worker threads even after the client disconnects.
How severe can the operational impact be?
A small number of requests can exhaust the HTTP worker thread pool; the description gives 25 requests as an example matching the default httpd.maxThreads setting. This can create a persistent denial of service that requires a server restart.
Which versions should be remediated?
Affected versions are 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2. Fixed releases are 3.12.10, 3.13.9, and 3.14.3.