This vulnerability allows an attacker to cause resource exhaustion by submitting crafted regular expressions with large repetitions or exponential patterns in Gerrit’s search query predicates or REST API filters. The flaw arises because the user‑supplied regex is compiled into an unbounded automaton before request handling, leading to CPU starvation or JVM heap exhaustion that can trigger OutOfMemoryError and make the service unavailable. The issue is a classic ReDoS, identified by CWE-1333 and CWE-400.

Affected versions are Gerrit Code Review from 2.1.6 through 3.12.9, from 3.13.0 through 3.13.8, and from 3.14.0 through 3.14.2. The vulnerability appears in search predicates such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and REST endpoints RegexListSearcher and RefFilter. The fix is available in 3.12.10, 3.13.9, and 3.14.3 according to the vendor.

The CVSS score of 8.7 signals a high‑severity flaw. EPSS is not available, so the likelihood of automated exploitation remains unknown, but the vulnerability is trivially exploitable when unrestricted regex queries are accepted. It is not listed in the CISA KEV catalog. Attackers can send a specially crafted request containing a regex with large quantified repetitions or exponential DFA‑determination patterns; as the server compiles it on the request thread, it drains CPU and memory, potentially exhausting JVM capacity and blocking legitimate traffic. Mitigation requires vendor patches or disabling regex searching for unauthenticated users.