A critical denial of service vulnerability in Gerrit Code Review allows unauthenticated attackers to exhaust system resources and crash the service via specially crafted search queries.

The flaw exists within the ANTLR 3 search query parser due to inefficient algorithmic complexity (CWE-407) and uncontrolled resource consumption (CWE-400). Unauthenticated remote attackers can send crafted queries with deeply nested parentheses to multiple endpoints, causing CPU exhaustion and HTTP worker thread pool starvation that requires a manual server restart to resolve.

This vulnerability poses a significant risk to operational continuity, as it allows an unauthenticated attacker to render the Gerrit platform entirely unavailable. With a CVSS score of 8.7, the high severity reflects the ease of exploitation and the potential for total service disruption, which could halt development workflows and prevent code repository access across an entire organization.

Immediate Action: Upgrade to Gerrit Code Review versions 3.12.10, 3.13.9, or 3.14.3 immediately to implement the required query parser fixes.

Proactive Monitoring: Monitor server logs and HTTP worker thread utilization for sudden spikes in resource consumption or recurring requests to search endpoints containing deeply nested parentheses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an upstream proxy to inspect and filter incoming queries, blocking requests that contain excessive or malformed nested parentheses.

Public Exploit Available: No

The potential for a permanent denial of service via simple, unauthenticated requests makes this a high-priority remediation task. Organizations should verify their current version of Gerrit Code Review and apply the provided patches immediately to prevent malicious actors from disrupting essential development operations.