CVE-2026-78594
published 2026-09-02CVE-2026-78594: Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An…
PriorityP426medium4.9CVSS 3.1
AVNACLPRHUINSUCNINAH
EPSS
0.50%
42.5th percentile
Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | apm_server | — | — |
| elastic | apm_server | >= 8.0.0 < 8.19.20 | 8.19.20 |
| elastic | apm_server | 8.0.0 – 8.19.19 | — |
| elastic | apm_server | >= 9.0.0 < 9.4.5 | 9.4.5 |
| elastic | apm_server | 9.0.0 – 9.4.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic APM Server up to 8.19.19/9.4.4/9.5.0 data amplification (Nessus ID 347966)
vuldb·2026-09-18·CVSS 4.9
CVE-2026-78594 [MEDIUM] Elastic APM Server up to 8.19.19/9.4.4/9.5.0 data amplification (Nessus ID 347966)
A vulnerability was found in Elastic APM Server up to 8.19.19/9.4.4/9.5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation results in highly compressed data.
This vulnerability was named CVE-2026-78594. The attack may be performed from remote. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130).
ghsa_unreviewed·2026-09-02
CVE-2026-78594 [MEDIUM] CWE-409 Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130).
Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-02
Published