CVE-2026-78594: APM Server DOS Vulnerability

CVE-2026-78594 Overview

CVE-2026-78594 affects Elastic APM Server through improper handling of highly compressed data [CWE-409]. An authenticated user with write access to source map content can store specially crafted, highly compressed payloads. When APM Server later processes this content, memory allocation exhausts available resources and terminates the process. The denial of service condition persists across restarts until an administrator removes the stored content.

Elastic disclosed the issue in security update ESA-2026-152 covering APM Server versions 8.19.20, 9.4.5, and 9.5.1.

Critical Impact
Persistent process termination on every APM Server restart until malicious source map content is removed from storage.

Affected Products

Elastic APM Server versions prior to 8.19.20
Elastic APM Server versions prior to 9.4.5
Elastic APM Server versions prior to 9.5.1

Discovery Timeline

2026-09-02 - CVE-2026-78594 published to NVD
2026-09-02 - Last updated in NVD database
2026-09-02 - Elastic publishes security advisory ESA-2026-152

Technical Details for CVE-2026-78594

Vulnerability Analysis

The vulnerability resides in how APM Server processes stored source map content. Source maps are used to translate minified JavaScript back to original source for error reporting. APM Server accepts compressed source map uploads and decompresses them during processing.

An authenticated user with write access can submit a compression bomb: a small compressed payload that expands to a very large size in memory. When APM Server later decompresses and processes this stored artifact, memory allocation exceeds available capacity and the process terminates. This maps to CAPEC-130 (Excessive Allocation).

Because the malicious content is persisted in storage, APM Server encounters the same payload on each restart. The service enters a crash loop until an administrator identifies and deletes the stored source map.

Root Cause

APM Server does not enforce bounds on the decompressed size of source map content before allocating memory. The processing path trusts the compressed input without validating expansion ratios or capping allocation. This is a classic instance of Improper Handling of Highly Compressed Data [CWE-409].

Attack Vector

Exploitation requires network access to the APM Server API and authenticated credentials with write permission to source map endpoints. An attacker uploads a compression bomb through the source map ingestion path. The impact materializes when APM Server processes the stored map, either during normal operation or on restart. See the Elastic Security Update ESA-2026-152 for advisory details.

Detection Methods for CVE-2026-78594

Indicators of Compromise

Repeated APM Server process terminations with out-of-memory errors in system or container logs
Unusually small source map uploads that expand to disproportionately large sizes during processing
Source map API write activity from accounts that do not normally publish source maps
APM Server restart loops correlated with source map processing events

Detection Strategies

Monitor APM Server memory utilization and alert on rapid growth followed by process exit
Audit source map upload activity, focusing on payload compression ratios and uploader identity
Correlate APM Server crashes across restarts to identify persistent trigger content
Review authentication logs for accounts holding write access to APM source map endpoints

Monitoring Recommendations

Ingest APM Server logs and host telemetry into a centralized analytics platform for crash pattern analysis
Track API calls to source map storage endpoints with request size and user attribution
Alert on APM Server exit codes indicating memory allocation failure

How to Mitigate CVE-2026-78594

Immediate Actions Required

Upgrade APM Server to version 8.19.20, 9.4.5, or 9.5.1 as appropriate for your deployment track
Audit accounts with write access to source map content and remove unnecessary privileges
Inspect stored source maps for oversized decompressed content and remove suspicious entries
Rotate credentials for any account suspected of unauthorized source map writes

Patch Information

Elastic released fixed versions in security update ESA-2026-152. Upgrade to APM Server 8.19.20, 9.4.5, or 9.5.1 based on your current major version. Refer to the Elastic Security Update ESA-2026-152 for full release notes and upgrade guidance.

Workarounds

Restrict source map write permissions to a minimal set of trusted service accounts
Enforce network-level access controls on APM Server ingestion endpoints
If patching is delayed, purge stored source map content and disable source map ingestion until upgrade

bash

# Remove write privileges for source map endpoints in Elasticsearch role mapping
# Review and adjust the APM role definitions to limit source_map write access
# Consult Elastic documentation for the exact role privileges in your version