Denial of Service Vulnerability in APM Server by Elastic

CVE-2026-78594

What is CVE-2026-78594?

A vulnerability in Elastic's APM Server allows an authenticated user with write access to potentially exploit the system by storing specially crafted, highly compressed data. When processed, this data can cause excessive memory allocation, leading to a persistent denial of service. The issue manifests every time the APM Server is started, as it exhausts the available memory, resulting in the termination of the process. To restore normal operations, the malicious content must be removed from storage.

References