CVE-2026-78594 — MEDIUM (4.9)

Q: How severe is CVE-2026-78594?

CVE-2026-78594 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-78594?

Check the references section above for vendor advisories and patch information. Affected products include: Elastic Apm Server.

Vulnerability Description

Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.

CVSS Score

4.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Elastic	Apm Server	>= 8.0.0, < 8.19.20

Related Weaknesses (CWE)

CWE-409

References

https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-Vendor AdvisoryMitigation

FAQ

What is CVE-2026-78594?

CVE-2026-78594 is a vulnerability with a CVSS score of 4.9 (MEDIUM). Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source m...

How severe is CVE-2026-78594?

CVE-2026-78594 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-78594?

Check the references section above for vendor advisories and patch information. Affected products include: Elastic Apm Server.