Description

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T16:17:51.757Z",
  "pubdate": "2026-08-17T16:17:51.757Z",
  "executiveSummary": "A Denial of Service (DoS) vulnerability exists in JetBrains YouTrack prior to version 2026.2.18177. The vulnerability stems from improper handling of compressed data structures within the import endpoint, allowing unauthenticated or authenticated malicious actors to trigger a decompression bomb attack. By submitting a specially crafted, highly compressed archive to the vulnerable import functionality, an attacker can exhaust server resources such as CPU and memory during the decompression phase. The resulting resource depletion leads to service degradation or complete application unavailability, impacting all tenants and users hosted on the affected YouTrack instance. The risk implication is significant as it disrupts business continuity and operational workflows dependent on the issue-tracking platform. Exploitation requires network access to the YouTrack import endpoint and the delivery of a maliciously crafted payload designed to amplify resource consumption upon extraction on the server side.",
  "technicalDetails": "The vulnerability resides in the data ingestion and processing logic associated with the import endpoint of JetBrains YouTrack. Specifically, the affected component fails to enforce adequate resource limits, safety thresholds, or validation checks when processing compressed payloads. A decompression bomb, often referred to as a zip bomb, is a malicious archive file designed to consume an exponential amount of system memory, disk space, and CPU cycles when a parser or extraction routine attempts to decompress it.\nThe attack flow proceeds as follows: First, the adversary constructs a small, highly compressed payload containing an enormous volume of redundant data. Second, the attacker transmits this malicious payload via an HTTP request directed at the YouTrack import endpoint. Third, the backend application reads the incoming stream and invokes the vulnerable decompression routine to process the archive. Fourth, as the extraction engine processes the compressed data, it rapidly exhausts available system memory and saturates CPU capacity attempting to expand the recursive payload. Finally, the Java Virtual Machine (JVM) hosting the YouTrack application encounters resource exhaustion, leading to OutOfMemoryError exceptions, thread starvation, or application crashes, thereby denying access to legitimate users.\nThe vulnerability affects JetBrains YouTrack versions prior to 2026.2.18177. The root cause is the absence of strict input validation, decompression size limits, and ratio checks on incoming archive streams. Network exposure includes any interface exposing the import endpoint to potential clients. Depending on the configuration of the import feature, exploitation may involve specific authentication or privilege requirements, but the consequence remains a complete disruption of service integrity due to unhandled resource amplification during parsing operations."
}