CVE-2026-100267
Quick assessment
Affected
JetBrains YouTrack
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 JetBrains YouTrack 2026.2.19197 之前的版本中，攻击者可通过邮箱正则表达式邮件规则过滤器发起拒绝服务（DoS）攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100267
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100267
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100267
请登录查看更多情报信息。
Vendor Pages for CVE-2026-100267 (1)
Same Patch Batch · JetBrains · 2026-09-30 · 28 CVEs total
| CVE-2026-100277 | 8.9 HIGH | JetBrains YouTrack 2026.2前账户接管漏洞 |
| CVE-2026-100254 | 8.8 HIGH | TeamCity多版本Git配置CRLF注入致命令执行 |
| CVE-2026-100253 | 8.8 HIGH | TeamCity多版本Kotlin DSL沙箱逃逸致代码执行 |
| CVE-2026-100273 | 8.2 HIGH | JetBrains YouTrack 2026.2前脚本调试器授权绕过 |
| CVE-2026-100255 | 8.1 HIGH | JetBrains TeamCity多版本管理员账户接管漏洞 |
| CVE-2026-100256 | 7.8 HIGH | IntelliJ IDEA 2026.2.3前结构搜索RCE漏洞 |
| CVE-2026-100268 | 7.7 HIGH | JetBrains YouTrack 2026.2前跨项目评论越权读取漏洞 |
| CVE-2026-100266 | 7.7 HIGH | JetBrains Hub 2026.2前授权缺失致任意邮件 |
| CVE-2026-100262 | 7.6 HIGH | JetBrains YouTrack越权覆盖通知模板漏洞 |
| CVE-2026-100275 | 6.9 MEDIUM | JetBrains YouTrack 2026.2前存储型XSS漏洞 |
| CVE-2026-100279 | 6.5 MEDIUM | JetBrains YouTrack 2026.2前集成URL凭据泄露 |
| CVE-2026-100274 | 6.5 MEDIUM | JetBrains YouTrack 2026.2前通知模板DoS漏洞 |
| CVE-2026-100276 | 5.9 MEDIUM | JetBrains YouTrack 2026.2前工作流越权漏洞 |
| CVE-2026-100261 | 5.4 MEDIUM | JetBrains YouTrack 2026.2.18991前权限绕过漏洞 |
| CVE-2026-100260 | 5.3 MEDIUM | JetBrains YouTrack 2026.2前邮箱集成认证绕过漏洞 |
| CVE-2026-100272 | 4.9 MEDIUM | JetBrains YouTrack 2026.2前通知预览越权漏洞 |
| CVE-2026-100278 | 4.9 MEDIUM | JetBrains YouTrack 2026.2前权限绕过漏洞 |
| CVE-2026-100265 | 4.8 MEDIUM | JetBrains Rider 2026.2.1前AI助手技能自动更新漏洞 |
| CVE-2026-100263 | 4.7 MEDIUM | JetBrains YouTrack 2026.2前存储型HTML注入漏洞 |
| CVE-2026-100259 | 4.3 MEDIUM | JetBrains YouTrack 2026.2前甘特图访问控制不当 |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same weakness: CWE-1333
-
CVE-2026-103043
anchorme through 3.0.8 Regular Expression Denial of Service -
CVE-2026-102473
Dash: dash: super-polynomial backtracking in pmatch when lib -
CVE-2026-102270
PyJWT: ReDoS vulnerability when calling the `is_pem_format` -
CVE-2026-101903
Axios: ReDoS in fromDataURI data: URL parser freezes the Nod -
CVE-2026-67413
RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Ca
V. Comments for CVE-2026-100267
No comments yet