CVE-2026-75050

Executive Summary

CVE-2026-75050 is an unauthenticated-to-low-privilege denial-of-service vulnerability in JetBrains YouTrack, a widely deployed project management and issue-tracking platform. The flaw allows an attacker with network access to a YouTrack instance to submit crafted type parameters, triggering unbounded resource allocation (CWE-770) that can exhaust CPU and memory and render the service unavailable. With a CVSS score of 7.1 (High), the primary impact is on availability (A:H), with a minor confidentiality component (C:L); no integrity impact is present. As of this report, no public exploit code, no CISA KEV listing, and no EPSS score are available, and no patch confirmation exists from tracked sources.

Technical Analysis

The vulnerability is rooted in how JetBrains YouTrack parses and resolves type parameters across its feature set — most plausibly in search queries, workflow type expressions, or REST API parameters that accept user-controlled type syntax. The NVD description is sparse, stating only that "DoS attack was possible via crafted type parameters," so the exact parser component, request endpoint, and payload structure cannot be confirmed from available data.

The assigned weakness, CWE-770 (Allocation of Resources Without Limits or Throttling), indicates that the affected code path performs memory or CPU allocation that is not bounded by any sane limit. Crafted type parameters are the trigger mechanism. This is characteristic of algorithmic-complexity vulnerabilities and entity-expansion attacks, where a small request (from an attacker's perspective) causes disproportionately large server-side work. For example, deeply nested generic type declarations, self-referential type expressions, or combinatorial permutations of union/intersection types can cause the parser to recurse excessively or allocate memory proportional to an exponential blow-up.

The CVSS vector provides important constraints:

• AV:N — the attack is exploitable remotely over the network; no physical or local access is required.
• AC:L — no special attack conditions are required; exploitation does not depend on race conditions or difficult environmental configurations.
• PR:L — the attacker needs low-privileged access, meaning a standard authenticated user account (or any account with access to the affected input surface). This rules out purely unauthenticated exploitation in the most likely attack paths, but a compromised low-privilege account or self-registration (if enabled) is sufficient.
• UI:N — no user interaction is required; the attack is fully automated once the attacker can send requests.
• S:U — the impact is confined to the vulnerable component; the security scope is unchanged.
• C:L — a low confidentiality impact exists, possibly via error messages or timing side-channels that leak parser state; this is secondary.
• A:H — high availability impact; successful exploitation can render the target YouTrack instance unresponsive.

YouTrack is a self-hostable web application that enterprises commonly expose to internal networks or, in some deployments, the internet. The attack surface is any HTTP-facing endpoint that ingests type parameters. Because the issue affects all builds before 2026.1.13901 and before 2026.2.17950, both the 2026.1 and 2026.2 release lines are impacted, and older/major legacy versions are presumed vulnerable as well unless they were independently fixed.

Insufficient technical detail is available to name specific functions, classes, URL endpoints, or parser internals. The analysis above is derived strictly from the NVD description, the CWE classification, and the CVSS vector.

Exploitation Scenarios

No public PoC is available for CVE-2026-75050; the attack chain below is inferred from the vulnerability class (resource exhaustion via crafted input) and the CVSS properties.

1. Reconnaissance / target identification. An attacker first identifies reachable YouTrack instances. This is straightforward via internet-wide scanning (e.g., Shodan queries for YouTrack banners and titles) or, in an enterprise context, by enumerating internal web applications. The attacker then determines the version, either from the login page footer, the REST API version endpoint, or by fingerprinting static assets. If the version is below 2026.1.13901 or 2026.2.17950, the target is presumed vulnerable.

2. Triggering the flaw. The attacker authenticates with a low-privileged account (PR:L). This is a realistic constraint because many YouTrack deployments create restricted accounts for external collaborators or allow self-registration. The attacker then crafts HTTP requests containing maliciously structured type parameter values — e.g., deeply nested type expressions or syntactically complex type strings designed to maximize parser work per byte. These are submitted to the endpoint(s) that accept type parameters, such as search/query interfaces or workflow configuration inputs.

3. Execution / payload mechanism. The malformed type parameter is parsed by the YouTrack type-resolution machinery. Because allocation is unbounded (CWE-770), the parser begins consuming CPU cycles and memory in proportion to the complexity of the crafted type, potentially far beyond the size of the transmitted request. Each request may be small (hundreds of bytes) but force megabytes of allocation or seconds of CPU time. The attacker repeats the request in parallel across multiple sessions/connections, multiplying the resource drain.

4. Post-exploitation impact. The YouTrack process becomes unresponsive or is killed by the OS out-of-memory killer. Legitimate users cannot log in, open issues, or run searches. Additional effects may include denial of service for the entire application server if multiple services share the process. The low confidentiality component (C:L) suggests some information leak is possible — potentially via timing differentials that reveal whether a type parameter is valid, or error responses that disclose configuration details. There is no data integrity impact; the attack is a pure availability play, suitable for a disgruntled insider, a competitor, or as part of a broader disruption campaign.

Impact Assessment

The business impact of CVE-2026-75050 is concentrated on availability. YouTrack functions as the system of record for development workflows, incident tracking, and project planning in many organizations; a prolonged outage halts ticketing, blocks engineering coordination, and can delay incident response or compliance reporting. Because the attacker requires only low privileges and can repeat the attack indefinitely, even a small number of malicious accounts can keep the service down repeatedly.

The CVSS subscores support this assessment:

• C:L — limited confidentiality impact; no evidence of data exfiltration or broad information disclosure.
• I:N — no integrity impact; tickets and configuration remain unmodified.
• A:H — high availability impact; the core DoS outcome.

The blast radius is somewhat contained by the network-facing nature of the issue: exploitation is limited to the YouTrack application, and the CVSS scope (S:U) indicates the attacker cannot pivot from this flaw to adjacent components. However, in shared hosting environments, CPU/memory exhaustion can degrade co-located applications. The vulnerability requires no user interaction and has a low attack complexity, which makes it attractive for automated exploitation once payload methodology becomes public. With no CISA KEV listing and no EPSS score available at the time of writing, there is currently no evidence of in-the-wild exploitation; this status is unconfirmed and should be re-evaluated as new telemetry emerges.

Detection Guidance

The detection content below is intentionally generic because the exact vulnerable endpoint is undisclosed. All rules target the vulnerability class — anomalous request size, repeated submissions of type-parameter-bearing requests, and resulting server errors — and should be tuned to local baselines.

Sigma Rule

title: JetBrains YouTrack Crafted Type Parameter DoS Attempt (CVE-2026-75050)
id: e4f9c1a2-7b3d-4e5f-9a8c-0d1e2f3a4b5c
status: experimental
description: Detects HTTP requests to YouTrack endpoints containing 'type' parameters of abnormal length or high volume, consistent with CWE-770 resource exhaustion.
author: Threat Intelligence Team
logsource:
  category: webserver
  product: nginx
detection:
  selection_uri:
    cs_uri_stem|contains:
      - 'youtrack'
      - 'api'
    cs_uri_query|contains: 'type='
  selection_length:
    cs_uri_query|length: '>= 512'
  selection_errors:
    sc_status:
      - '500'
      - '503'
      - '502'
  condition: selection_uri and selection_length and selection_errors
  timeframe: 5m
falsepositives:
  - Legitimate complex search queries submitted by administrators
  - Automated API clients using verbose type expressions
level: high

YARA Rule

rule CVE_2026_75050_YouTrack_TypeParam_DoS
{
    meta:
        author = "Threat Intelligence Team"
        description = "Detects payload patterns associated with CVE-2026-75050 crafted type parameter DoS attempts against JetBrains YouTrack"
        cve = "CVE-2026-75050"
        date = "2026-06-01"
        severity = "high"
    strings:
        $type_param = /[?&]type=[^&\s]{256,}/i
        $nested = /(?:type\s*[:=]\s*[^&\s]*){4,}/i
        $url_youtrack = /(?:youtrack|api)[^"\s]*[?&]type=/i
        $server_error = /HTTP\/1\.[01] [45]\d\d/i
    condition:
        any of them and filesize < 2MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT JetBrains YouTrack Crafted Type Parameter DoS Attempt (CVE-2026-75050)"; flow:established,to_server; content:"type="; http_uri; pcre:"/(?:[?&]type=)[^&\s]{512,}/iR"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; sid:202675050; rev:1; metadata:created_at 2026_06_01, updated_at 2026_06_01;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ http where url.path : "*youtrack*" and url.query : "*type=*" and lengthOf(url.query) > 512 ]
  [ http where url.path : "*youtrack*" and url.query : "*type=*" and lengthOf(url.query) > 512 ]
  [ http where url.path : "*youtrack*" and url.query : "*type=*" and lengthOf(url.query) > 512 ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_query, "%type=%") AND len(uri_query) > 512
| stats count by src_ip uri status
| where count > 20
| eval severity = if(status IN ("500","502","503"), "HIGH", "MEDIUM")
| table _time src_ip uri status count severity

Wazuh OSSEC Rule

<group name="youtrack,">
    <rule id="100750" level="10">
        <decoded_as>web</decoded_as>
        <field name="url" type="pcre2">(?i)(?:youtrack|api)[^"\s]*[?&]type=.{512,}</field>
        <description>CVE-2026-75050: Possible crafted type parameter DoS attempt against JetBrains YouTrack</description>
        <group>dos,</group>
    </rule>
    <rule id="100751" level="12">
        <if_sid>100750</if_sid>
        <match>500|502|503</match>
        <description>CVE-2026-75050: YouTrack server error following large type parameter request — possible successful DoS</description>
        <group>dos,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no tracked source confirms an available patch or vendor advisory. The NVD description names two fixed builds (2026.1.13901 and 2026.2.17950), and upgrading to one of these is the presumed remediation, but this cannot be independently confirmed from the provided intelligence data. Until a patch is verified, organizations should treat vulnerable builds as unpatched and apply the following layers of defense:

1. Immediate mitigations (no patch yet):

   • Restrict network access to YouTrack so the application is reachable only from trusted networks; do not expose it directly to the internet where it can be discovered by scanners.
   • Disable self-registration and guest access to raise the privilege requirement from "low" to at least "authenticated employee."
   • Place a Web Application Firewall (WAF) or reverse proxy in front of YouTrack with rate limiting per source IP and request-size limits (e.g., reject query strings over 1,000 characters).
   • Continuously monitor CPU and memory utilization on the YouTrack host; configure automated restart policies and alerting on sustained high resource consumption.

2. Patch / upgrade steps:

   • Watch for an official JetBrains security advisory for CVE-2026-75050 and confirm the fix. If confirmed, upgrade to YouTrack 2026.1.13901 or 2026.2.17950 (or a later build) as soon as possible.
   • Test the upgrade in a staging environment that mirrors production workflows and REST API integrations before deployment.
   • Follow the JetBrains upgrade procedure for self-hosted YouTrack, including configuration and database backups.

3. Long-term hardening:

   • Apply the principle of least privilege: audit all user accounts in YouTrack and remove unnecessary low-privilege access, especially for external collaborators.
   • Enable verbose auditing of failed requests and anomalous API usage; correlate with host-level CPU/memory telemetry.
   • Establish a vendor-tracking process so that YouTrack security bulletins are ingested into the organization's vulnerability management system within 24 hours of release.
   • Consider running YouTrack in a container with strict CPU/memory cgroup limits so that a successful resource-exhaustion attack is contained to the container and does not take down the host.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-75050
2. MITRE CWE-770 — https://cwe.mitre.org/data/definitions/770.html
3. MITRE ATT&CK T1499 — https://attack.mitre.org/techniques/T1499/
4. JetBrains YouTrack product/security page — https://www.jetbrains.com/youtrack/

Additional notes: CISA KEV does not list CVE-2026-75050 as of this report. No EPSS score has been published by FIRST.org. No threat-actor campaigns or exploit-in-the-wild activity have been identified in the provided data; this status should be rechecked regularly.