The flaw permits a regular expression denial‑of‑service attack by using a crafted regex in mailbox rule filters, which can cause the YouTrack instance to consume excessive CPU and become unresponsive, resulting in a loss of availability.

All JetBrains YouTrack versions prior to 2026.2.19197 are vulnerable; users with sufficient privileges to create or modify mailbox rule filters can exploit the issue.

With a CVSS score of 5.9 the vulnerability carries a moderate severity rating, no exploit probability data is available, and it is not listed in the CISA KEV catalog. The attack likely requires a valid user session or administrative access to define or edit mailbox rule filters, after which the regex processing can exhaust resources and lead to service disruption.