Elastic APM Server CVE-2026-78594

Exploitation requires an authenticated account with write (ingest) access to APM Server's source map content endpoint - a high-privilege role (PR:H per CVSS). No special network positioning is required; the attack is executed over the standard APM Server HTTP/S API (AV:N, AC:L). The vulnerability is limited to the source map processing path specifically: generic APM event ingestion does not trigger this code. There is no user interaction required from other users or administrators to trigger the crash - the server processes stored source maps autonomously. The persistent recurrence is bounded only by whether an administrator can locate and remove the malicious content before the next restart cycle.

The CVSS 3.1 score of 4.9 (Medium) accurately reflects the high-privilege prerequisite (PR:H), which substantially limits the attack surface to users with explicit write access to the source map API - not the general authenticated user population. Despite the moderate score, the persistence mechanic is the defining risk amplifier: unlike a transient DoS, this vulnerability puts the APM Server into an unrecoverable crash loop that requires administrative intervention on disk, not just a restart. Even a mid-sized municipal IT team in inowroclaw running Elastic APM for infrastructure observability would face a complete APM visibility blackout until the malicious source map is identified and removed. No KEV listing and no public exploit code are confirmed at time of analysis, keeping real-world exploitation probability low absent an insider or compromised privileged account. EPSS data was not provided in the input; given PR:H and no KEV, opportunistic mass exploitation is unlikely.

An attacker with a privileged APM Server account - or an insider with source map upload rights - crafts a polyglot zip-bomb payload compressed to a few kilobytes that decompresses to tens of gigabytes, then uploads it via the source map API. On the next source map processing cycle, APM Server attempts full decompression, exhausts all available heap, and the process is terminated by the OS OOM killer. Every subsequent restart re-triggers the same processing path and the same crash, rendering APM monitoring permanently unavailable until an administrator manually purges the stored artifact.