CVE-2026-78594: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) in Elastic Apm Server

This vulnerability (CWE-409) in Elastic APM Server allows an authenticated user with write permissions to source map content to upload highly compressed data that, when decompressed by the server, causes excessive memory allocation. This results in the termination of the APM Server process, causing a persistent denial of service condition that persists across restarts until the offending data is deleted. The CVSS 3.1 score is 4.9 (medium), reflecting network attack vector, low complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

The impact is a persistent denial of service condition on the Elastic APM Server, causing the server process to terminate due to memory exhaustion when processing maliciously crafted compressed data. This affects availability but does not impact confidentiality or integrity. The denial of service recurs on every server restart until the malicious data is removed.

No official patch or remediation is currently available. Users should monitor for updates from Elastic and consider removing any suspicious or highly compressed source map content that could trigger this condition. Since the vulnerability requires authenticated write access, controlling and auditing user permissions may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.