CVE-2026-75050 in YouTrack
Summary
by MITRE • 08/17/2026
In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in JetBrains YouTrack versions prior to 2026.1.13901 and 2026.2.17950 represents a significant denial of service risk stemming from improper handling of input data within the application's query parsing engine. This flaw is primarily categorized under CWE-400, which describes uncontrolled resource consumption, as it allows an attacker to exhaust system resources such as CPU cycles or memory through specifically crafted inputs rather than causing a direct crash via buffer overflow or code execution. The core technical issue lies in how the application processes type parameters during query evaluation, where certain malformed structures trigger inefficient algorithmic paths that scale poorly with input complexity.
When a user submits a search query containing deeply nested or recursively structured type parameters, the underlying parser may enter an exponential time-complexity loop while attempting to resolve types and validate constraints against the database schema. This behavior is characteristic of ReDoS (Regular Expression Denial of Service) patterns or inefficient recursive descent parsing logic that fails to implement proper depth limits or timeout mechanisms for complex query structures. The vulnerability does not require authentication in many configurations, allowing unauthenticated actors to target the service endpoint responsible for processing search queries and triggering resource exhaustion across all available threads within the application server.
The operational impact of this denial of service attack is severe for organizations relying on YouTrack for project management and issue tracking workflows. By consuming excessive CPU resources or causing thread pool saturation, an attacker can render the web interface unresponsive to legitimate users, effectively halting development operations that depend on real-time access to ticket data and status updates. This disruption affects not only individual productivity but also disrupts automated integrations such as CI/CD pipelines that query YouTrack for build statuses or deployment approvals, leading to broader operational downtime beyond just the user interface layer.
Mitigation strategies focus primarily on upgrading to patched versions of JetBrains YouTrack where these parsing logic flaws have been addressed through optimized algorithms and stricter input validation rules. Organizations should also implement network-level protections such as rate limiting on search endpoints to throttle requests from single sources, thereby reducing the likelihood of successful resource exhaustion attacks in environments where immediate patching is not feasible. Additionally, configuring web application firewalls with specific rule sets designed to detect anomalous query patterns involving deeply nested structures can provide an additional layer of defense against exploitation attempts targeting this vulnerability class aligned with ATT&CK technique T1498 Network Denial of Service.