CVE-2026-103492 in YouTrack
Summary
by MITRE • 10/01/2026
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.19422 represents a significant denial of service risk stemming from the application's handling of image file metadata, specifically within Portable Network Graphics (PNG) files that contain embedded Photoshop Document (PSD) data or are misidentified as such during processing. This flaw allows an attacker to craft maliciously formatted PSD attachments that exploit inefficient parsing logic within the server-side image processing libraries used by YouTrack. When a user uploads an issue attachment containing this crafted file, the backend service attempts to generate thumbnails and process the image for display purposes. The specific technical failure occurs when the parser encounters malformed or excessively complex structural elements within the PSD header or associated data streams that trigger infinite loops or excessive memory allocation patterns rather than failing gracefully with a validation error.
From a technical perspective, this vulnerability is classified under CWE-400, which denotes Uncontrolled Resource Consumption, and more specifically aligns with CWE-617 regarding Reachable Assertion if the processing logic relies on internal assumptions about file structure that are violated by the crafted input. The attack vector leverages the fact that many image libraries attempt to parse multiple formats or fallback mechanisms when standard headers do not match expected signatures perfectly. By embedding PSD-specific structures within a container that triggers these fallback paths, an attacker can force the Java Virtual Machine running YouTrack into a state of high CPU utilization or memory exhaustion. This results in the degradation of service for all users accessing the instance, as threads become blocked waiting for resource allocation or are terminated by garbage collection processes attempting to recover from out-of-memory conditions.
The operational impact of this vulnerability is severe within collaborative development environments where YouTrack serves as a central hub for issue tracking and project management. A successful exploitation does not require authentication in some configurations if file upload features are enabled, although it typically requires at least guest-level access or the ability to attach files to public issues. The consequence is a complete disruption of service availability, preventing developers from logging bugs, updating ticket statuses, or accessing documentation hosted within the platform. In cloud-hosted deployments, this can lead to cascading failures affecting multiple tenants if resource limits are not strictly enforced at the infrastructure level. Furthermore, repeated attempts may trigger automated security monitoring systems as false positives for distributed denial of service attacks, potentially leading to unintended IP blocking or account suspensions for legitimate users generating traffic patterns similar to the attack vectors.
Mitigation strategies primarily involve upgrading to JetBrains YouTrack version 2026.2.19422 or later, where the underlying image processing libraries have been patched to validate file structures more rigorously and implement strict timeouts on parsing operations. Administrators should also enforce input validation policies that restrict allowed file types for attachments to only those strictly necessary for project workflows, thereby reducing the attack surface. Implementing web application firewall rules that inspect uploaded files for anomalous entropy or unexpected header signatures can provide an additional layer of defense by blocking malicious payloads before they reach the application logic. Regular security audits and penetration testing focused on file upload mechanisms are recommended to identify similar weaknesses in other integrated components within the YouTrack ecosystem, ensuring resilience against resource exhaustion attacks across all user-facing endpoints.