CVE-2026-78594

Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110	Vendor Advisory Mitigation

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:elastic:apm_server::::::::
	cpe:2.3:a:elastic:apm_server::::::::
	cpe:2.3:a:elastic:apm_server:9.5.0:::::::*

History

No history.

Information

Published : 2026-09-02 15:17

Updated : 2026-09-03 19:13

NVD link : CVE-2026-78594

Mitre link : CVE-2026-78594

CVE.ORG link : CVE-2026-78594

JSON object : View

Products Affected

elastic

apm_server

CWE

CWE-409

Improper Handling of Highly Compressed Data (Data Amplification)

{"id": "CVE-2026-78594", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78594", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-02T15:44:44.239209Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Apm Server", "versions": [{"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "8.19.19"}, {"status": "affected", "version": "9.0.0", "versionType": "semver", "lessThanOrEqual": "9.4.4"}, {"status": "affected", "version": "9.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-02T15:17:40.700", "references": [{"url": "https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110", "tags": ["Vendor Advisory", "Mitigation"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-409"}]}], "descriptions": [{"lang": "en", "value": "Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed."}], "lastModified": "2026-09-03T19:13:49.230", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:apm_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81638476-40DE-4AE4-A9BC-FD19B84FF638", "versionEndExcluding": "8.19.20", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:elastic:apm_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7DA1479-F31C-40C2-87D2-5CF02D1073D6", "versionEndExcluding": "9.4.5", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:elastic:apm_server:9.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "299D9250-EB19-4E6E-98E3-F8D0DE7261C3"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}