Gerrit Code Review CVE-2026-87721

Exploitation targets Gerrit's query-evaluation endpoints specifically: /changes/?q=, /accounts/?q=, /groups/?query=, /projects/?query=, /Documentation/?q=, /changes/{id}/query?expression=, or the SSH 'gerrit query' command. The trigger is a search query containing deeply nested parentheses that forces the ANTLR 3 QueryParser (Query.g) to recurse through conditionOr/conditionAnd via conditionBase without memoization before capability or visibility checks. No authentication is required in the DEFAULT configuration where anonymous read access is enabled (PR:N); the primary LIMITING factor is that if an operator has disabled anonymous read, a valid authenticated (but unprivileged) account is needed. Amplification depends on httpd.maxThreads - about 25 concurrent requests match the default and are enough to starve the pool; the lack of thread abort on client disconnect makes the resulting exhaustion persistent until a manual restart.

This is a genuine operational priority for Gerrit operators, not a high-CVSS-but-low-real-risk item. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, base 8.7) aligns tightly with the description: fully remote, low complexity, no privileges, no user interaction, and a High availability impact with no confidentiality/integrity effect - a pure availability attack. The description makes the impact concrete and severe: because the ANTLR 3 QueryParser recurses through conditionBase without memoization BEFORE capability/visibility checks, and worker threads never abort on client disconnect, roughly 25 crafted requests (matching the default httpd.maxThreads) can permanently pin the entire HTTP worker pool and require a server restart - a persistent, low-effort DoS rather than a transient slowdown. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; the absence of these signals does not lower the intrinsic exploitability, which is trivial once the technique is understood. One important conditional: the CVSS PR:N assumes the default posture where anonymous read access is enabled - the description explicitly notes that if anonymous read is disabled, an authenticated (but otherwise unprivileged) user is required, which modestly limits exposure for hardened instances. Overall: real priority for internet-facing or large-org Gerrit deployments; patch promptly.

An attacker locates an internet-reachable Gerrit instance with anonymous read enabled (the default) and sends a handful of crafted search queries containing deeply nested parentheses to a query endpoint such as /changes/?q=. Each request drives unbounded, unmemoized ANTLR recursion on a worker thread that never aborts even after the client disconnects, so about 25 such requests exhaust the default httpd.maxThreads pool and leave the server unresponsive until an administrator restarts it. No public exploit code is identified at time of analysis, but the technique requires no authentication or special tooling in the default configuration.