CVE-2024-50574 Overview
CVE-2024-50574 is a Regular Expression Denial of Service (ReDoS) vulnerability in JetBrains YouTrack versions before 2024.3.47707. The flaw resides in the email header parsing logic within the Helpdesk functionality. A remote, unauthenticated attacker can submit a crafted email whose header triggers catastrophic backtracking in a vulnerable regular expression. This exhausts CPU resources and degrades or halts service availability. The issue is tracked under CWE-1333: Inefficient Regular Expression Complexity and affects integrity-free, confidentiality-free availability only.
Critical Impact
Unauthenticated attackers can exhaust CPU on YouTrack Helpdesk instances by sending a single crafted email, leading to denial of service.
Affected Products
- JetBrains YouTrack versions prior to 2024.3.47707
- YouTrack Helpdesk functionality (email ingestion component)
- Both self-hosted YouTrack Server deployments processing inbound mail
Discovery Timeline
- 2024-10-28 - CVE-2024-50574 published to the National Vulnerability Database
- 2024-10-29 - Last updated in NVD database
Technical Details for CVE-2024-50574
Vulnerability Analysis
The vulnerability stems from an inefficient regular expression used when parsing email headers received by the YouTrack Helpdesk module. When the parser evaluates a maliciously crafted header value, the regex engine enters catastrophic backtracking. CPU utilization spikes and the request thread stalls, blocking legitimate Helpdesk traffic. Because Helpdesk channels are designed to accept email from external senders, no authentication is required to deliver the malicious payload. Repeated submissions amplify the impact and can render the YouTrack instance unresponsive.
Root Cause
The root cause is an inefficient regular expression pattern [CWE-1333] applied to attacker-controlled email header input. Patterns containing nested quantifiers or overlapping alternations exhibit exponential time complexity against adversarial input. The Helpdesk pipeline did not constrain header length or impose an execution timeout on regex evaluation before the fix in 2024.3.47707.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker sends an email to an address monitored by the YouTrack Helpdesk integration. The crafted header value forces the regex engine into prolonged backtracking, consuming a worker thread and CPU cycles. Sustained delivery of such messages can result in full denial of service for the YouTrack instance. JetBrains documents the fix in the JetBrains Security Issues Fixed page.
Detection Methods for CVE-2024-50574
Indicators of Compromise
- Sustained high CPU usage on the YouTrack application server without a corresponding rise in legitimate user requests.
- Inbound emails to Helpdesk channels containing unusually long or malformed header fields.
- Increased request latency or timeouts on YouTrack Helpdesk ticket creation endpoints.
- Thread dumps showing worker threads stuck inside regular expression matching routines.
Detection Strategies
- Monitor JVM thread state for threads blocked in java.util.regex.Matcher for extended periods.
- Correlate spikes in YouTrack CPU usage with timestamps of inbound Helpdesk emails.
- Review mail gateway logs for repeated messages from the same sender targeting Helpdesk addresses.
Monitoring Recommendations
- Enable application performance monitoring on the YouTrack process with alerts on CPU saturation lasting more than 30 seconds.
- Forward YouTrack and mail relay logs to a centralized SIEM for correlation and retention.
- Track Helpdesk message ingestion rates and flag anomalous senders or oversized headers.
How to Mitigate CVE-2024-50574
Immediate Actions Required
- Upgrade JetBrains YouTrack to version 2024.3.47707 or later without delay.
- Inventory all YouTrack instances exposing Helpdesk email channels to external senders.
- Restrict inbound email to Helpdesk addresses through allowlists or upstream mail filtering where feasible.
- Validate that mail gateways enforce maximum header length limits to reduce attacker payload space.
Patch Information
JetBrains addressed CVE-2024-50574 in YouTrack 2024.3.47707. The fix corrects the email header parsing logic in the Helpdesk component to prevent catastrophic regex backtracking. Customers should consult the JetBrains Security Issues Fixed advisory for upgrade guidance and release notes.
Workarounds
- Temporarily disable the Helpdesk email integration until the upgrade is applied.
- Place a mail filtering gateway in front of YouTrack to drop messages with abnormally long header fields.
- Limit network exposure of the YouTrack instance to trusted sender domains during the remediation window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
