← Back to the live CVE advisory feed

CVE-2026-87721: Product identification pending

Severity

8.7 (HIGH)

Vendor

GOOGLE

Affected versions

Through 3.12.9

Patch status

Unknown

Published

2026-09-24T22:17:02.327

Modified

2026-09-24T22:17:02.327

Why it matters

This matters because the affected product has SSH, tunneling, or file-management capabilities. Compromise could let an attacker execute commands or interact with managed systems.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a persistent denial of service (CPU exhaustion and HTTP worker thread pool starvation requiring a server restart) via crafted search queries containing deeply nested parentheses sent to query evaluation endpoints (/changes/?q=, /accounts/?q=, /groups/?query=, /projects/?query=, /Documentation/?q=, /changes/{id}/query?expression=, or SSH gerrit query). Because syntactic predicates in conditionOr and conditionAnd recurse via conditionBase without memoization prior to capability or visibility checks and worker threads do not abort when the client disconnects, a small number of requests (such as 25 requests matching default httpd.maxThreads) can permanently pin all HTTP worker threads. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

View the official NVD record for CVE-2026-87721

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.