Denial of Service via Decompression Bomb in JetBrains YouTrack

Executive Summary

This vulnerability in JetBrains YouTrack before 2026.2.18177 allows a denial-of-service (DoS) attack through a decompression bomb in the import endpoint. A decompression bomb is a malicious file that expands significantly when decompressed, overwhelming system resources.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a decompression bomb attack in JetBrains YouTrack's import endpoint. To detect it, monitor for unusually large or rapid decompression operations in network traffic or system logs. Check for processes consuming excessive CPU or memory during import operations. Inspect network traffic for repeated large payloads to the import endpoint. Ensure your YouTrack instance is updated to version 2026.2.18177 or later to mitigate this issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause system downtime or slow performance by consuming excessive CPU, memory, or disk space during the decompression process. It may disrupt normal operations of the YouTrack instance.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a denial-of-service attack via a decompression bomb, which could disrupt service availability. This may impact compliance with regulations like GDPR (availability principle) or HIPAA (accessibility requirements) if it leads to prolonged system unavailability.

Useful 0 Not Useful 0

Mitigation Strategies

Update JetBrains YouTrack to version 2026.2.18177 or later to address the decompression bomb vulnerability in the import endpoint.

Useful 0 Not Useful 0