The flaw is an uncontrolled resource consumption vulnerability in the ANTLR 3 search query parser used by Gerrit Code Review. Crafted search queries with deeply nested parentheses trigger exponential backtracking, leading to CPU exhaustion and starvation of the HTTP worker thread pool. In response, all HTTP worker threads become permanently pinned, requiring a server restart. The impact is a persistent denial of service that compromises system availability for all users.

All Gerrit Code Review installations of version 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 are affected. The product is the Gerrit code review tool provided by the Gerrit vendor.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the lack of mitigations and the small number of requests needed for exploitation (e.g., 25 requests for a default thread pool) suggest a high likelihood of exploitation by unauthenticated or any authenticated user if anonymous read access is disabled. Attackers can initiate the exploit through HTTP query endpoints (/changes/?q=, /accounts/?q=, etc.) or the SSH gerrit query method. The vulnerability remains unfixed in the listed versions, so risk is substantial until a patch is applied.