4.9
CVE-2026-78594
- EPSS 0.25%
- Veröffentlicht 02.09.2026 14:43:13
- Zuletzt bearbeitet 03.09.2026 19:13:49
- Erkennungen
Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service
Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Elastic ≫ Apm Server Version >= 8.0.0 < 8.19.20
Elastic ≫ Apm Server Version >= 9.0.0 < 9.4.5
Elastic ≫ Apm Server Version 9.5.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.25% | 0.164 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security@elastic.co | 4.9 | 1.2 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
|
CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110