EUVD-2026-60246
GHSA-cfpf-r4pf-9hjm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable import endpoint requires low-privilege authentication (PR:L); decompression bomb causes full availability loss (A:H) with zero confidentiality or integrity impact.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint
AnalysisAI
Denial-of-service in JetBrains YouTrack before 2026.2.18177 allows an authenticated low-privileged user to exhaust server resources by uploading a decompression bomb to the import endpoint. The CVSS vector confirms full availability impact (A:H) with no confidentiality or integrity consequences. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid YouTrack user account with at least low-privilege access (PR:L per CVSS vector), meaning fully anonymous exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (Medium) is well-calibrated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid YouTrack account - even a low-privilege one - crafts a decompression bomb archive (e.g., a deeply nested zip with repetitive data achieving a 1000:1 or greater compression ratio) and submits it to the import endpoint. The server begins decompressing the file, rapidly exhausting available memory or CPU, causing YouTrack to become unresponsive or crash and denying service to all other users. … |
| Remediation | Upgrade JetBrains YouTrack to version 2026.2.18177 or later, which is the confirmed patched release per the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today