CyberSecBulletin

Gerrit vulnerabilities

We track 3 vulnerabilities in Gerrit products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 24, 2026.

3vulnerabilities
0critical
3high
0exploited
8.3average CVSS score

Latest Gerrit vulnerabilities

  • 8.7 High severity

    Gerrit: Uncontrolled Resource Consumption

    CVE-2026-87722Gerrit

    Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling predicates) and REST regex filter endpoints (RegexListSearcher /projects/?r= and RefFilte

  • 8.7 High severity

    Gerrit: Uncontrolled Resource Consumption

    CVE-2026-87721Gerrit

    Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (o

  • 7.6 High severity

    Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix)…

    CVE-2026-87720Gerrit

    Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an aut