CVE-2026-78594

MEDIUM 4.9CVE-2026-78594 · Published 02/09/2026 · updated 03/09/2026

In short

CVE-2026-78594 is a MEDIUM (CVSS 4.9) vulnerability affecting apm server (elastic).
Chance of exploitation in the next 30 days (EPSS): 0.50%, higher than 42.8% of all vulnerabilities.
Fix: update to 8.19.20, 9.4.5 or later.

Package	Affected versions	Patched versions
apm server elastic	`= 9.5.0≥ 8.0.0, < 8.19.20≥ 9.0.0, < 9.4.5`	`8.19.209.4.5`

Description

Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.

References

discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110 · Vendor Advisory

More vulnerabilities in apm server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apm server

elastic

= 9.5.0≥ 8.0.0, < 8.19.20≥ 9.0.0, < 9.4.5

8.19.209.4.5

Description

More vulnerabilities in apm server

See all →