EUVD-2026-70058
GHSA-5jf2-hccc-p8fm
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Write access to source maps requires high privilege (PR:H); persistent availability destruction justifies A:H; no confidentiality or integrity impact.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
1DescriptionCVE.org
Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.
AnalysisAI
Persistent denial of service in Elastic APM Server allows an authenticated user with write access to source map content to upload specially crafted, highly compressed payloads that exhaust server memory upon processing. The condition (CWE-409, CAPEC-130) is self-reinforcing: every restart triggers re-processing of the stored content and re-crashes the server, making recovery impossible without manual removal of the malicious content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account with write (ingest) access to APM Server's source map content endpoint - a high-privilege role (PR:H per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.9 (Medium) accurately reflects the high-privilege prerequisite (PR:H), which substantially limits the attack surface to users with explicit write access to the source map API - not the general authenticated user population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade APM Server to a patched release per ESA-2026-152: inferred fixed versions from the advisory URL are 8.19.20 (8.x branch), 9.4.5 (9.4.x branch), and 9.5.1 (9.5.x branch) - confirm exact versions at https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110 before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apm Server
View allAn issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that index
It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whe
APM server logs contain document body from a partially failed bulk index request. Rated medium severity (CVSS 6.5), this
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today