Gerrit vulnerabilities

Products

• Gerrit 6

Latest Gerrit CVEs

Newest publication first

1. CVE-2026-87722 Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code Review

   Published 2026-09-24

   High·CVSS 8.7 EPSS 0.32%

   Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling predicates) and REST regex filter endpoints (RegexListSearcher /projects/?r= and RefFilter /projects/{project...

2. CVE-2026-87721 Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review

   Published 2026-09-24

   High·CVSS 8.7 EPSS 0.32%

   Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated u...

3. CVE-2026-87720 Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review

   Published 2026-09-24

   High·CVSS 7.6 EPSS 0.31%

   Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user (or...

4. CVE-2026-2725 Improper Authorization in Gerrit allowing Code Review Bypass via "Submitted Together"

   Published 2026-05-13

   Medium·CVSS 6.0 EPSS 0.12%

   Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a secondary branch to bypass code review and forcefully submit code to restricted branches via a crafted submission matchi...

5. CVE-2020-8920 Overoptimization leads to private information leak in Gerrit

   Published 2020-12-10

   Low·CVSS 3.5 EPSS 0.37%

   An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access...

6. CVE-2020-8919 Information leakage in Gerrit

   Published 2020-12-10

   Low·CVSS 3.5 EPSS 0.32%

   An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the default set of priviledges to read all other user's personal account data as well as s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.