Elastic APM Server: CVE-2026-78594 (CWE-409 DoV)

APM Server Security Update (ESA-2026-152) Vulnerability Overview Vulnerability Name: Improper handling of highly compressed data in APM Server, leading to sustained unavailability of the service (CWE-409: Excessive Memory Allocation due to Data Amplification, CAPEC-130) Severity Level: Medium (CVSS v3.1: 4.9) CVE ID: CVE-2026-78594 Description: A CWE-409 vulnerability in APM Server can lead to sustained unavailability of the service. An authenticated user with write access to source map content can store specially crafted, highly compressed content. When processed, this content exhausts the available memory of the APM Server, causing the process to terminate. This issue persists across restarts until the stored content is removed. Scope of Impact Affected Versions: - 8.x: from 8.0.0 through 8.19.19 (inclusive) - 9.x: from 9.0.0 through 9.4.4 (inclusive) - 9.x: 9.5.0 Affected Configurations: - APM Server instances with Real User Monitoring (RUM) enabled and source map fetching configured. - RUM is disabled by default; deployments that have not explicitly enabled this feature are not affected. Remediation Fixed Versions: APM Server 8.19.20, 9.4.5, 9.5.1 Mitigations for Users Unable to Upgrade: - In APM Server binary deployments, set to to disable source map processing (while retaining other RUM functionality). This option does not apply to Fleet-managed deployments. - Alternatively, set to to completely disable RUM (since RUM is disabled by default, deployments that have not enabled it require no action). PoC / Exploit Code No PoC code or exploit code block is included in the document.

Goal Reached Thanks to every supporter — we hit 100%!

Elastic APM Server: CVE-2026-78594 (CWE-409 DoV)