An unauthenticated remote attacker can trigger a denial of service on Gerrit instances by submitting crafted regular expressions that exhaust system resources.

This vulnerability is an uncontrolled resource consumption flaw (CWE-400/CWE-1333) occurring when the application compiles user-supplied regular expressions into an unbounded automaton instance before performing access control checks. It allows unauthenticated remote attackers to trigger severe CPU and memory exhaustion via specially crafted search queries or REST API requests.

The ability for an unauthenticated attacker to cause a denial of service poses a significant risk to development workflows and CI/CD pipelines reliant on Gerrit. Given the CVSS score of 8.7, this represents a high-severity threat that can lead to total service unavailability, preventing code reviews and integration tasks. Prolonged outages may result in substantial operational delays and loss of engineering productivity.

Immediate Action: Upgrade Gerrit Code Review installations to version 3.12.10, 3.13.9, or 3.14.3 to incorporate the necessary regex handling protections.

Proactive Monitoring: Review application logs for unusually high numbers of requests to project search or branch filtering endpoints, particularly those originating from single IP addresses. Monitor JVM heap usage and thread counts for spikes associated with regex processing.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect and block incoming REST API requests containing suspicious or overly complex regular expression patterns. Restrict access to search and API endpoints to trusted networks if public exposure is not strictly required.

Public Exploit Available: Unknown

Due to the high severity and the ease of triggering this denial of service condition, organizations should prioritize patching their Gerrit instances immediately. The vulnerability permits unauthenticated attackers to disrupt critical infrastructure, making rapid deployment of the fixed versions 3.12.10, 3.13.9, or 3.14.3 essential to maintaining system availability.