Executive brief
Elastic APM Server, a performance monitoring component used to track application behavior and performance in production systems, contains a vulnerability in source map processing. An authenticated user with write access could upload specially compressed content that consumes all available memory when processed, crashing the service. This condition persists across restarts, requiring manual removal of the malicious content to restore operations.
Technical details
The vulnerability is a data amplification issue (CWE-409) in APM Server's source map processing functionality. An authenticated user with write access to source map content can upload highly compressed payloads that, when decompressed and processed, exhaust available memory and terminate the APM Server process. The attack requires Real User Monitoring (RUM) to be enabled with source map fetching configured (both disabled by default). The vulnerability affects APM Server versions 8.0.0–8.19.19 and 9.0.0–9.4.4, with patches available in 8.19.20, 9.4.5, and 9.5.1. Mitigation options include disabling source map processing or RUM entirely for deployments that cannot upgrade immediately.
Affected products
- Elastic APM Server 8.0.0 through 8.19.19, 9.0.0 through 9.4.4
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Fixed in APM Server 8.19.20, 9.4.5, and 9.5.1