EUVD-2026-60249
GHSA-vpmg-58mp-x36w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Network-reachable API requiring only a valid session (PR:L); no complexity; high availability loss from resource exhaustion; C:L retained from vendor-supplied vector pending clarification.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters
AnalysisAI
Denial-of-service in JetBrains YouTrack before versions 2026.1.13901 and 2026.2.17950 allows authenticated remote attackers to exhaust server resources by submitting crafted type parameters, rendering the service unavailable. The vulnerability stems from uncontrolled resource consumption (CWE-770), where malformed input is not bounded before processing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the YouTrack instance (PR:L per CVSS vector) - any low-privilege account such as a standard developer or reporter is sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 reflects high availability impact (A:H) paired with low confidentiality impact (C:L) and no integrity impact, with a network attack vector and low complexity - meaning any authenticated user can reliably trigger the condition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated YouTrack user - including a low-privileged developer or reporter account - sends a sequence of API requests containing specially crafted type parameters designed to trigger excessive resource allocation on the server. The server processes these without throttling, leading to CPU or memory exhaustion and rendering YouTrack unavailable to all users. … |
| Remediation | Upgrade JetBrains YouTrack to version 2026.1.13901 or later in the 2026.1 branch, or to version 2026.2.17950 or later in the 2026.2 branch, per the vendor's fixed-version disclosure at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all YouTrack instances and determine which are running affected versions (anything before 2026.1.13901 or 2026.2.17950) and assess the number of authenticated users with access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today