CVE-2026-100267 in YouTrack
Summary
by MITRE • 09/30/2026
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.19197 represents a significant security risk stemming from the implementation of regular expression handling within the application's email integration subsystem. Specifically, this flaw is categorized as a Regular Expression Denial of Service, commonly referred to as ReDoS. This type of vulnerability arises when an attacker can supply input that causes the regex engine to perform an excessive number of operations due to catastrophic backtracking. In the context of YouTrack, the attack vector targets the mailbox rules used for filtering incoming emails. These filters are designed to parse and categorize email content based on specific patterns defined by administrators or system configurations. When a maliciously crafted input is processed against these regex-based mail-rule filters, it triggers an algorithmic complexity explosion within the regular expression engine.
The technical root cause lies in the structure of the regular expressions used for parsing mailbox data. Regular expression engines typically employ backtracking algorithms to find matches when patterns involve quantifiers such as stars or plus signs applied to groups that can overlap or match empty strings. If a regex pattern is not carefully constructed with atomic grouping, possessive quantifiers, or other optimizations, certain inputs can force the engine into an exponential time complexity state. In this specific instance, the mail-rule filters likely contain patterns designed to extract metadata or content from email headers and bodies without sufficient constraints on how these patterns handle ambiguous input sequences. An attacker who has access to the mailbox integration point, whether through authenticated user actions or potentially via unauthenticated endpoints depending on the deployment configuration, can craft an email payload that exploits this ambiguity. The resulting computational load consumes significant CPU resources, effectively halting normal operations for the affected service instance.
From a security perspective, this vulnerability aligns with CWE-400, which covers Uncontrolled Resource Consumption, and more specifically CWE-1335, Inefficient Regular Expression Complexity. It also maps to MITRE ATT&CK technique T1496, Resource Hijacking, where adversaries use computing resources for their own purposes or to disrupt service availability. The operational impact of this vulnerability is primarily centered on denial of service rather than data exfiltration or remote code execution in its immediate form. However, the consequences are severe for system stability and reliability. A successful ReDoS attack can cause the YouTrack server process to become unresponsive, leading to timeouts for all users attempting to access the issue tracking platform. This disruption affects workflow continuity, prevents timely response to critical issues tracked within the system, and may require manual intervention such as restarting services or clearing queues to restore normal functionality. In high-availability environments, this could trigger failover mechanisms unnecessarily, increasing operational costs and complexity.
Mitigation strategies for this vulnerability focus on both immediate remediation and long-term defensive coding practices. The primary and most effective mitigation is upgrading JetBrains YouTrack to version 2026.2.19197 or later, where the developers have presumably refactored the regular expressions involved in mailbox rule processing to eliminate catastrophic backtracking paths. This may involve replacing complex regex patterns with more efficient parsing logic, implementing strict input length limits on email fields processed by these rules, or utilizing non-backtracking engines if available within the underlying framework. For organizations unable to upgrade immediately due to operational constraints, temporary mitigations include restricting access to mailbox integration endpoints to trusted IP ranges only and monitoring system resources for unusual CPU spikes correlated with incoming mail processing events. Additionally, security teams should review existing mail-rule configurations to ensure they do not rely on nested quantifiers or overlapping groups that could be exploited by crafted inputs until the patch is applied. Regular auditing of third-party component dependencies and their regex implementations remains a critical best practice in maintaining robust application security posture against algorithmic complexity attacks.