CVE-2026-75047 in YouTrack
Summary
by MITRE • 08/17/2026
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.18177 represents a significant availability risk stemming from improper handling of compressed data within the application's import functionality. This flaw is classified as an Improperly Controlled Modification of Object Behavior with Regular Expression, or more commonly known as a decompression bomb attack, which falls under CWE-409 in the Common Weakness Enumeration taxonomy. The core technical issue lies in the server-side processing logic that accepts user-supplied compressed archives for data import operations without implementing adequate safeguards against excessively large uncompressed outputs relative to their compressed size. Attackers can craft malicious archive files containing deeply nested compression layers or high-ratio content, such as repeated patterns of null bytes or other easily compressible data structures. When the YouTrack server attempts to decompress these payloads during the import process, it allocates memory proportional to the final uncompressed size rather than limiting consumption based on the input file size or a predefined threshold.
This architectural oversight allows an unauthenticated or authenticated attacker with access to the import endpoint to trigger a denial of service condition by exhausting system resources. As the server processes the malicious payload, CPU cycles are consumed in decompression operations while memory allocation balloons rapidly until the application process is terminated by the operating system due to out-of-memory errors, or the entire host machine becomes unresponsive if multiple such requests are processed concurrently. The operational impact of this vulnerability extends beyond simple service interruption; it can lead to data corruption if partial imports occur before termination, and it creates a persistent availability gap that undermines trust in the platform's reliability for critical project tracking workflows. Since YouTrack is often used as a central hub for development teams, an outage caused by such an attack disrupts sprint planning, bug tracking, and collaboration efforts across the organization.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1496, Resource Hijacking, specifically through denial of service via resource exhaustion. The exploitation vector typically involves sending specially crafted HTTP requests to the import API endpoint containing the malicious archive in the request body or as an uploaded file component. Defenders and administrators must prioritize patching immediately by upgrading to version 2026.2.18177 or later, where JetBrains has implemented strict limits on decompression depth and output size validation. In environments where immediate patching is not feasible, network-level mitigations such as rate limiting on the import endpoint, increasing file upload size restrictions for non-whitelisted users, and deploying web application firewalls with rules to detect anomalous compression ratios can provide temporary relief. Additionally, configuring server-side timeouts and memory limits specific to archive processing functions can help mitigate the severity of potential exploitation attempts until a permanent code fix is applied.