| Package | Affected versions | Patched versions |
|---|---|---|
| gerrit | ≥ 2.16.0, < 2.16.26≥ 3.0.0, < 3.0.16≥ 3.1.0, < 3.1.12≥ 3.2.0, < 3.2.7≥ 3.3.0, < 3.3.2< 2.15.22 | 2.16.263.0.163.1.123.2.73.3.22.15.22 |
Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispose of the session. Over multiple git actions, this can lead to a heap memory exhaustion for Gerrit servers. We recommend upgrading Gerrit to any of the versions listed above.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free