CVE-2021-22553: Google Gerrit

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispose of the session. Over multiple git actions, this can lead to a heap memory exhaustion for Gerrit servers. We recommend upgrading Gerrit to any of the versions listed above.

Affected products

• Google Gerrit: before 2.15.22 (fixed in 2.15.22); from 2.16.0, before 2.16.26 (fixed in 2.16.26); from 3.0.0, before 3.0.16 (fixed in 3.0.16); from 3.1.0, before 3.1.12 (fixed in 3.1.12); from 3.2.0, before 3.2.7 (fixed in 3.2.7); from 3.3.0, before 3.3.2 (fixed in 3.3.2)

Published 2021-02-17. Last modified 2026-06-17.