Description

Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-02T15:17:40.700Z",
  "pubdate": "2026-09-02T15:17:40.700Z",
  "executiveSummary": "This vulnerability involves an Improper Handling of Highly Compressed Data (CWE-409) within the APM Server, leading to a persistent Denial of Service (DoS) condition via Excessive Allocation (CAPEC-130).\nThe flaw allows an authenticated user with write access to source map content to upload a maliciously crafted, highly compressed payload. When the APM Server attempts to process this data, it triggers excessive memory consumption, ultimately causing the process to terminate.\nThe impact is significant because the malicious payload is stored persistently; the APM Server will repeatedly crash upon restart during the automated re-processing of the stored data, resulting in a persistent availability disruption.\nExploitation requires authenticated access with the specific permission to write or upload source map content. Because the crash persists across restarts, the system remains non-functional until administrative intervention removes the malicious payload from the storage mechanism.",
  "technicalDetails": "The root cause of this vulnerability is the lack of proper validation and resource constraints when decompressing incoming source map data within the APM Server. This flaw corresponds to CWE-409, where the application does not account for the expansion ratio of compressed data, commonly known as a decompression bomb attack.\nThe attack flow begins with an authenticated attacker possessing the requisite privileges to submit or update source map files to the APM Server. The attacker crafts a payload utilizing high-ratio compression techniques (e.g., Gzip or similar formats) that appear small in their compressed state but expand exponentially upon decompression.\nWhen the APM Server receives and subsequently processes the source map—triggered by normal ingestion or service startup routines—the decompression algorithm attempts to allocate a memory buffer proportionate to the expected uncompressed size of the data. Due to the lack of input sanitization or explicit limits on the decompression expansion factor, the APM Server experiences a rapid, excessive allocation of memory.\nThis behavior leads to OOM (Out-of-Memory) conditions, forcing the operating system to terminate the APM Server process. Because the source map content is committed to the application's persistent storage, the system will attempt to reload and process the malicious payload immediately upon subsequent service restarts.\nThis ensures that the denial of service state is not transient but persistent, effectively locking the APM Server into a continuous crash-loop. The exploitation leverages CAPEC-130, focusing on exhausting the memory resources of the service to induce a crash.\nThe vulnerability is restricted to environments where user authentication is successfully established, and the attacker has sufficient authorization to interact with the source map storage endpoints. The scope of the attack is limited to the APM Server instance, but the persistent nature of the DoS necessitates manual cleanup of the persistent storage layer or database to restore service availability."
}