Google Gerrit vulnerabilities

4 CVEs affecting Google Gerrit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-2725, published 2026-05-13.

More from Google.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-8920, published 2020-12-10. Low severity, CVSS 3.5. EPSS: 0.4% chance of exploitation in the next 30 days. An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the…
• CVE-2021-22553, published 2021-02-17. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispose of the session. Over multiple git actions, this can lead…
• CVE-2020-8919, published 2020-12-10. Low severity, CVSS 3.5. EPSS: 0.3% chance of exploitation in the next 30 days. An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the…
• CVE-2026-2725, published 2026-05-13. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a secondary branch to bypass code review…