CVE-2026-87722 Gerrit CVE debrief

Who should care

Defenders responsible for Gerrit Code Review deployments should assess exposure and prioritize patching or mitigating this vulnerability to prevent potential denial-of-service attacks. This includes reviewing compensating controls, monitoring for suspicious activity, and verifying security team awareness of vulnerability details.

Why it matters

CVE-2026-87722 is a high-severity vulnerability in Gerrit Code Review that allows unauthenticated remote attackers to cause a denial of service. Defenders should prioritize patching or mitigating this vulnerability to prevent potential denial-of-service attacks.

• Denial of service via CPU starvation and JVM heap exhaustion
• Potential for unauthenticated remote attacks
• Need for patching or mitigation to prevent exploitation

Technical summary

The vulnerability is caused by uncontrolled resource consumption in regex search query predicates and REST regex filter endpoints in Gerrit Code Review versions 2.1.6 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2. This allows an unauthenticated remote attacker to cause a denial of service via CPU starvation and JVM heap exhaustion. The user-supplied regular expression is compiled into an unbounded dk.brics.automaton instance prior to index evaluation or access control visibility filtering, leading to potential denial-of-service attacks.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential denial-of-service attacks.

Recommended defensive actions

• Patch Gerrit Code Review to version 3.12.10, 3.13.9, or 3.14.3
• Restrict access to search queries and REST API requests
• Monitor for suspicious activity
• Implement compensating controls for exposed systems
• Review asset inventory for affected deployments
• Track exceptions and retest remediated assets
• Verify security team awareness of vulnerability details

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is caused by uncontrolled resource consumption in regex search query predicates and REST regex filter endpoints. Official CVE Program record and NIST NVD detail page provide source-provided CVE metadata and vulnerability assessment. Evidence limits are based on CVE and NVD entries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.