JetBrains YouTrack EUVD-2026-90011

Requires the target YouTrack instance to have the mailbox integration enabled with regex-based mail-rule filters configured - a non-default, operator-dependent feature. Exploitation is unauthenticated (PR:N) and requires no user interaction (UI:N) since the malicious email is processed automatically, but AC:H reflects the need for the vulnerable mail-rule configuration to be present and for the attacker to craft input that forces catastrophic regex backtracking. Impact is limited to availability (CPU/thread exhaustion / denial of service); there is no confidentiality or integrity effect. Instances that do not use mailbox mail-rule regex filtering are not exposed.

This is a genuine but modest-priority availability issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9) tells a coherent story: network-reachable and pre-authentication (PR:N), but high attack complexity (AC:H) and impact limited strictly to availability (C:N/I:N/A:H) - a classic ReDoS/catastrophic-backtracking denial of service, consistent with CWE-1333 (Inefficient Regular Expression Complexity). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation - this looks like a vendor-discovered hardening fix rather than an urgent threat. The AC:H rating is meaningful here: exploitation depends on the YouTrack instance actually using mailbox/mail-rule regex filters, and on the attacker crafting input that triggers pathological backtracking, which limits real-world reach. Net: real defect, patch available, but not an emergency - prioritize during normal patch cycles unless the mailbox integration is heavily used. No data is directly conflicting; the main gap is the absence of exploitation-probability signals (EPSS/KEV/POC all absent), which is neutral, not exonerating.

An attacker sends a specially crafted email to a mailbox that a YouTrack instance monitors, where the message content or headers are evaluated against regex-based mail-rule filters. The malicious string triggers catastrophic regex backtracking (ReDoS), consuming CPU and stalling the mail-processing thread, degrading or denying service. No public exploit code is identified, and success requires the mailbox regex mail-rule feature to be configured, matching the high attack complexity.