CVE-2026-78594

Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.

• CWE-409

• https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110Vendor Advisory, Mitigation

Published

Sep 2, 2026

Last Modified

Sep 3, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78588Allocation of Resources Without Limits or Throttling (CWE-77…6.5
• CVE-2026-7859The Motors WordPress plugin before 1.4.110 does not have pr…5.3
• CVE-2026-78590Improper Limitation of a Pathname to a Restricted Directory …7.3
• CVE-2026-78591Improper Limitation of a Pathname to a Restricted Directory …6.3
• CVE-2026-78592Improper Limitation of a Pathname to a Restricted Directory …7.3
• CVE-2026-78593An insufficiently validated configuration field in Kibana's …4.3
• CVE-2026-78595Missing Authorization in Kibana Leading to Information Discl…4.3
• CVE-2026-78596Missing Authorization in Kibana Leading to Unauthorized Modi…4.3
• CVE-2026-78597Missing Authorization (CWE-862) in the Kibana Entity Store f…4.3
• CVE-2026-78598Incorrect Authorization (CWE-863) in the Kibana machine lear…5.4
• CVE-2026-78599Improper Limitation of a Pathname to a Restricted Directory …6.5
• CVE-2026-7860A possible information disclosure vulnerability exists in th…1.6