Is CVE-2026-78594 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78594 being exploited in the wild.

How severe is CVE-2026-78594?

Medium severity, with a CVSS score of 4.9, published 2 September 2026.

Which products and versions are affected?

Elastic Apm Server 8.0.0 through 8.19.19, 9.0.0 through 9.4.4.

Is there a fix for CVE-2026-78594?

A patch was published on 2026-09-02: Fixed in APM Server 8.19.20, 9.4.5, and 9.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78594 attacked?

It is attacked over the network.

Am I affected by CVE-2026-78594?

Check whether you run Elastic Apm Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78594: Elastic APM Server improper handling of compressed data denial of service

CVE-2026-78594 · Severity: medium · CVSS 4.9 · Published 2026-09-02

Elastic APM Server, a performance monitoring component used to track application behavior and performance in production systems, contains a vulnerability in source map processing. An authenticated user with write access could upload specially compressed content that consumes all available memory when processed, crashing the service. This condition persists across restarts, requiring manual removal of the malicious content to restore operations.

Technologies: Elastic Apm Server. Vendors: Elastic.

Quick answers

Is CVE-2026-78594 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78594 being exploited in the wild.
How severe is CVE-2026-78594?: Medium severity, with a CVSS score of 4.9, published 2 September 2026.
Which products and versions are affected?: Elastic Apm Server 8.0.0 through 8.19.19, 9.0.0 through 9.4.4.
Is there a fix for CVE-2026-78594?: A patch was published on 2026-09-02: Fixed in APM Server 8.19.20, 9.4.5, and 9.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78594 attacked?: It is attacked over the network.
Am I affected by CVE-2026-78594?: Check whether you run Elastic Apm Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a data amplification issue (CWE-409) in APM Server's source map processing functionality. An authenticated user with write access to source map content can upload highly compressed payloads that, when decompressed and processed, exhaust available memory and terminate the APM Server process. The attack requires Real User Monitoring (RUM) to be enabled with source map fetching configured (both disabled by default). The vulnerability affects APM Server versions 8.0.0–8.19.19 and 9.0.0–9.4.4, with patches available in 8.19.20, 9.4.5, and 9.5.1. Mitigation options include disabling source map processing or RUM entirely for deployments that cannot upgrade immediately.

Affected products

Elastic APM Server 8.0.0 through 8.19.19, 9.0.0 through 9.4.4

Timeline

2026-09-02: disclosed
2026-09-02: patched: Fixed in APM Server 8.19.20, 9.4.5, and 9.5.1

References

https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.