CVE-2026-75047

Executive Summary

CVE-2026-75047 is a denial-of-service (DoS) vulnerability in JetBrains YouTrack versions prior to 2026.2.18177. The flaw exists in the product's import functionality, which fails to adequately handle highly compressed archive payloads, allowing an authenticated user with low privileges to submit a decompression bomb that exhausts server memory, CPU, and/or disk resources. The CVSS 3.1 base score is 6.5 (Medium) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, meaning the entire impact is on availability; there is no confidentiality or integrity loss. No public proof-of-concept, Nuclei template, or exploit code has been identified, and no threat actor campaigns or in-the-wild exploitation have been reported to date.

Technical Analysis

The vulnerability belongs to CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification), commonly known as a decompression bomb or "zip bomb" class of attacks. In this attack class, an attacker supplies a file (ZIP, GZIP, TAR, etc.) whose compressed size is very small but whose decompressed size is exponentially larger due to repeated, highly redundant data or nested archive structures. When a server-side parser naively decompresses such input without enforcing limits on total decompressed size, entry count, or compression ratio, the host process can consume unbounded memory and CPU, and the decompressed output can fill the filesystem, leading to process termination or complete service unresponsiveness.

Per the NVD description: "In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint." The description is sparse — it does not disclose the exact HTTP URI of the import endpoint, the authentication requirements, the underlying archive-parsing library, or the specific resource limit that was missing. Accordingly, this report analyzes the vulnerability at the CWE-409 class level and does not invent implementation details.

Key technical observations:

• Attack surface: The import endpoint of the YouTrack web application. YouTrack is a web-based issue tracking and project management product, typically deployed as a self-hosted Java application or available as a JetBrains-hosted cloud service. The import feature is intended to let users migrate data (e.g., issues, projects, users) from other trackers or from backup archives.
• Precondition: The CVSS vector requires low privileges (PR:L), so the attacker must possess a valid account with at least minimal rights, likely "Upload import" permissions or equivalent. The attack is remotely exploitable (AV:N) with no user interaction (UI:N).
• Failure condition: The import parser does not (in vulnerable versions) enforce an upper bound on decompressed payload size, number of archive entries, or compression ratio. A crafted archive can therefore trigger a data-amplification loop: a few hundred kilobytes of upload data can expand by a factor of hundreds or thousands.
• Exploit mechanism (class-level): The attacker crafts an archive containing entries filled with repetitive data (e.g., nested ZIP files, where each inner ZIP contains many copies, or a single file compressed with maximum ratio). Uploading this archive to the import endpoint causes the server-side decompressor to expand it in memory and/or on disk until the host's limits are exceeded.
• Single-component scope: CVSS S:U (Scope: Unchanged) indicates the resource exhaustion is confined to the YouTrack component itself rather than crossing a trust boundary. On a dedicated host, this affects only the YouTrack service; on shared infrastructure, disk exhaustion could degrade co-tenanted services, although this is outside the scored scope.

CVSS factor breakdown (derived from the vector):

• AV:N / AC:L — remotely exploitable over the network without special conditions.
• PR:L — requires an authenticated low-privileged account.
• UI:N — no victim interaction required.
• C:N / I:N / A:H — pure availability impact; the attacker cannot read or modify data but can crash or stall the service.

Exploitation Scenarios

No public PoC exists for CVE-2026-75047; the following attack chain is inferred strictly from the NVD description and the CWE-409 vulnerability class.

1. Reconnaissance / target identification. The attacker locates an exposed YouTrack instance. Common fingerprinting methods include browsing the login page, observing the title "YouTrack", or using network discovery to find the default HTTP/HTTPS ports. Any instance running a build prior to 2026.2.18177 is potentially affected. The attacker must then obtain valid low-privilege credentials — through legitimate account creation (if open registration is enabled), credential stuffing, or phishing. The PR:L component of the CVSS vector confirms that administrative rights are not required.

2. Crafting the malicious payload. The attacker generates a decompression bomb: a small archive (e.g., ZIP or GZIP) designed so that its fully decompressed content is orders of magnitude larger than the upload. Techniques include: a single highly compressible file (e.g., gigabytes of zeros), an archive containing thousands of small entries, or a nested "archive-in-archive" structure, where each level multiplies the expansion ratio. The exact acceptance criteria (allowed file extensions, size limits, MIME types) of the YouTrack import endpoint are not disclosed in the available data, so the attacker would probe with benign uploads first to determine accepted formats.

3. Triggering the flaw. Using the authenticated session, the attacker submits the crafted archive to the import endpoint. Because the vulnerable code path lacks strict decompression limits, the server begins to expand the archive into memory and/or temporary storage. The upload itself may be small enough to bypass any request-body size restrictions.

4. Post-exploitation impact. The decompression operation consumes available CPU, memory, and disk. In a severe case, the YouTrack process throws an out-of-memory error and crashes, or the host's disk fills with decompressed temporary files. The service becomes unavailable to all users, including administrators. Because the NVD description notes "doS attack was possible," one or more of these resource-exhaustion paths is confirmed at the vendor level. The attacker can repeat the process to keep the service down; the impact is a denial of service with no data loss or confidentiality breach.

It is acceptable to characterize this as: No public PoC available; attack chain is inferred from the vulnerability class (CWE-409). Specific URI paths, parser internals, and payload structures for YouTrack remain undisclosed in the public advisory data provided.

Impact Assessment

• Business impact: YouTrack is used by development teams for issue tracking, Scrum/Kanban boards, and project management. An extended outage halts ticket workflows, board updates, and cross-team coordination. For organizations relying on YouTrack as their ticketing system of record, a low-availability event cascades into delayed delivery and support response times.
• Affected systems: JetBrains YouTrack versions prior to 2026.2.18177. Because the description does not enumerate an explicit version range, all builds earlier than 2026.2.18177 should be considered vulnerable unless a vendor advisory proves otherwise.
• Blast radius: CVSS scope is Unchanged (S:U), meaning the resource exhaustion is confined to the YouTrack component. However, if YouTrack shares a host with other applications or services, disk exhaustion caused by decompressed temporary files could affect co-located workloads — an operational risk not captured by the CVSS score.
• Severity rationale: 6.5 (Medium) reflects a high availability impact (A:H), remote exploitability, and low attack complexity, but it is tempered by the requirement for a valid low-privileged account and the absence of confidentiality/integrity impact. EPSS has not yet been scored by FIRST.org; no value is fabricated here.

Detection Guidance

Detection of this vulnerability class is challenging because the malicious request may appear as a legitimate small upload. Detection strategy focuses on two signals: (1) anomalous HTTP traffic to the import endpoint, and (2) resource-exhaustion indicators in the YouTrack host process (CPU pegging, memory spikes, OutOfMemoryError, decompression exceptions). Rules below use generic import path matching; adjust to the actual deployed endpoint path in your environment.

Sigma Rule

title: JetBrains YouTrack CVE-2026-75047 Decompression Bomb Import Attempt
id: a7d3f2c1-4b5e-4d6f-9a0c-7e1b2c3d4e5f
status: experimental
description: Detects HTTP POST requests to the YouTrack import endpoint carrying small archive payloads, a profile consistent with decompression bomb (CWE-409) uploads targeting CVE-2026-75047.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75047
tags:
    - attack.t1499
    - cve.2026-75047
    - cwe.409
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.method: POST
        http.uri|contains: import
        http.content_type|startswith:
            - application/zip
            - application/gzip
            - application/x-gzip
            - application/x-tar
            - multipart/form-data
    filter_small_upload:
        http.request.bytes|>=: 104857600   # 100 MB legitimately large uploads excluded
    condition: selection and not filter_small_upload
    timeframe: 5m
level: medium
falsepositives:
    - Legitimate administrator-initiated data migrations with moderate archive sizes
    - Automated backup-restore workflows
fields:
    - src_ip
    - http.uri
    - http.request.bytes
    - http.content_type
    - user.name

Correlate this rule with host-level memory/CPU alerts for the YouTrack process to confirm a decompression bomb attempt.

YARA Rule

/*
    CVE-2026-75047 — JetBrains YouTrack decompression bomb (CWE-409)
    Targets archive uploads/samples with abnormal entry counts or extreme
    small-size-to-high-ratio characteristics.
    Note: YARA is most useful on captured HTTP bodies or files at rest;
    adjust thresholds based on legitimate import volumes.
*/
rule CVE_2026_75047_Youtrack_DecompressionBomb
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects ZIP/GZIP files exhibiting decompression-bomb heuristics (excessive entries or extreme compression ratio) targeting JetBrains YouTrack import"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75047"
        cve = "CVE-2026-75047"
        cwe = "CWE-409"
        tactic = "T1499"
    strings:
        $zip_local_header = { 50 4B 03 04 }      // PK\x03\x04
        $zip_eocd         = { 50 4B 05 06 }      // PK\x05\x06
        $gzip_magic       = { 1F 8B }
        $tar_magic        = { 75 73 74 61 72 }   // ustar
    condition:
        (uint16le(0) == 0x4B50 and #zip_local_header >= 500) or
        (uint16le(0) == 0x4B50 and #zip_local_header >= 50 and filesize < 102400) or
        ($gzip_magic at 0 and filesize < 102400) or
        ($tar_magic at 257 and filesize < 51200)
}

Suricata IDS Rule

# CVE-2026-75047 — JetBrains YouTrack import endpoint decompression bomb attempt
# Adjust http.uri content to match your YouTrack deployment's actual import path.
# NOTE: http.request_body content check assumes non-multipart upload; for multipart
# use file.data with image extraction enabled. Threshold suppresses noisy scanning.
alert http any any -> $HOME_NET any (
    msg:"CVE-2026-75047 JetBrains YouTrack Import Decompression Bomb Attempt (CWE-409)";
    flow:to_server,established;
    http.method:"POST";
    http.uri; content:"import"; nocase;
    http.content_type; content:"application/zip"; or
    http.content_type; content:"application/gzip"; or
    http.content_type; content:"application/x-tar"; or
    http.content_type; content:"multipart/form-data";
    file.data; content:"PK"; offset:0; depth:2;
    file.size;<20971520;
    threshold:type both, track by_src, seconds 300, count 10;
    reference:cve,2026-75047;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-75047;
    classtype:attempted-dos;
    sid:202675047; rev:1;
)

Elastic Detection

EQL query to correlate import-endpoint POSTs with process-level resource exhaustion on the YouTrack host (requires Elastic Endpoint or Auditbeat process data; adjust field names to your schema):

sequence with maxspan=10m
  [ http where event.category == "web" and http.request.method == "POST"
      and http.request.uri like "*import*"
      and http.request.bytes < 1000000 ]
  [ process where event.category == "process"
      and (process.name == "java" or process.name == "youtrack")
      and (process.cpu.usage > 90 or process.memory.usage > 80) ]

Fallback EQL for web-server logs alone (flags repeated small import uploads that produce 5xx errors):

http where event.category == "web" and http.request.method == "POST"
  and http.request.uri like "*import*"
  and http.request.bytes < 1000000
  and http.response.status_code >= 500

Splunk SPL Query

Search HTTP access logs for suspicious import upload patterns:

index=webserver OR index=proxy sourcetype=access_combined
| where method="POST" AND uri LIKE "%import%"
| stats count, min(bytes) AS min_bytes, max(bytes) AS max_bytes,
         earliest(_time) AS first_seen, latest(_time) AS last_seen
  BY src_ip, uri, status
| where count > 10 OR (max_bytes < 1000000 AND status >= 500)
| table first_seen, last_seen, src_ip, uri, count, min_bytes, max_bytes, status

Search YouTrack application logs for decompression/resource-exhaustion artifacts:

index=youtrack sourcetype=youtrack_logs
| search "OutOfMemoryError" OR "decompression" OR "ZipException" OR "too many entries" OR "zip bomb"
| stats count BY host, source, level, message
| sort - count

Wazuh OSSEC Rule

<group name="youtrack,">
    <!-- CVE-2026-75047: decompression bomb (CWE-409) against YouTrack import endpoint -->
    <rule id="399501" level="12">
        <decoded>decompression bomb|zip bomb|too many entries|ZipException|OutOfMemoryError</decoded>
        <description>CVE-2026-75047: Possible decompression bomb (zip bomb) attempt against JetBrains YouTrack import endpoint</description>
        <mitre><id>T1499</id></mitre>
        <group>dos,webserver,youtrack,</group>
    </rule>

    <!-- Escalation when the decompression failure is tied to the import path -->
    <rule id="399502" level="14">
        <if_sid>399501</if_sid>
        <match>import</match>
        <description>CVE-2026-75047: Decompression resource-exhaustion event correlated with YouTrack import endpoint</description>
        <group>dos,webserver,youtrack,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, patch binary, or official release note has been confirmed by any tracked source at the time of writing. The NVD description states the issue exists "before 2026.2.18177," which implies the patched build is 2026.2.18177, but this could not be independently verified.

1. Immediate mitigations:

   • Restrict the import endpoint by network ACL or reverse-proxy rules; allow only known administrative source IPs to reach it.
   • Disable the import feature for low-privileged roles until a verified patch is applied, if your YouTrack deployment supports role-based toggles for this capability.
   • Enforce upload size limits at the reverse proxy/WAF (e.g., reject archive uploads above a defined size) — this reduces but does not eliminate the risk, since decompression bombs are effective at small sizes.
   • Apply OS-level resource controls to the YouTrack process: systemd/cgroup CPU limits, memory ulimits, and temporary filesystem quotas (/tmp, import scratch space) to contain resource exhaustion.

2. Patch / upgrade steps:

   • Monitor the JetBrains YouTrack security advisory channel and the JetBrains YouTrack download/update page for an official release of 2026.2.18177 or later.
   • Test the upgrade in a staging environment, verifying that archive imports behave correctly and enforcing decompression limits if the vendor added a setting.
   • Upgrade all production and development YouTrack instances to the patched build as soon as it is verified; do not rely on the NVD description alone for patch confirmation.

3. Long-term hardening:

   • Enforce least privilege: review user roles so that archive-import capability is restricted to administrators only; remove open registration if enabled.
   • Add application-layer decompression-bomb controls (entry count limit, total decompressed size cap, compression-ratio limit) at the WAF or a sanitizing gateway in front of YouTrack.
   • Implement host-level monitoring for CPU, memory, and disk-usage anomalies on YouTrack servers, with alerting thresholds and auto-restart policies.
   • Segment the YouTrack host so that even disk exhaustion cannot impact adjacent business-critical services.
   • Keep a change log of the exact import endpoint behavior as new YouTrack versions ship, and re-test for CWE-409 resilience after each major upgrade.

References

• NVD Entry: CVE-2026-75047 — https://nvd.nist.gov/vuln/detail/CVE-2026-75047
• CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) — https://cwe.mitre.org/data/definitions/409.html
• MITRE ATT&CK Technique T1499: Endpoint Denial of Service — https://attack.mitre.org/techniques/T1499/
• OWASP: Denial of Service via Decompression Bomb ("Zip Bomb") — https://owasp.org/www-community/attacks/DoS_via_Decompression_Bomb
• JetBrains YouTrack product page/security updates (vendor advisory pending verification): https://www.jetbrains.com/youtrack/

Threat actor / exploit-in-the-wild status: No known threat actor campaigns, exploit-in-the-wild evidence, or published PoC exist for CVE-2026-75047 as of this report. CISA KEV does not list this CVE. EPSS has not been scored by FIRST.org. This report will be updated if vendor patch evidence or exploitation activity is confirmed.