CVE-2026-78594: Microsoft APM — MEDIUM

Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Microsoft APM	pip	—	No patch
3.7K Pushed 3d ago 62% patched ~7d to patch Full package profile →

Do you use Microsoft APM? You're affected.

How severe is it?

CVSS 3.1

4.9 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AV Network

AC Low

PR High

UI None

S Unchanged

C None

I None

A High

What should I do?

No patch available

Monitor for updates. Consider compensating controls or temporary mitigations.

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-78594?

Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.

Is CVE-2026-78594 actively exploited?

No confirmed active exploitation of CVE-2026-78594 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-78594?

No patch is currently available. Monitor vendor advisories for updates.

What is the CVSS score for CVE-2026-78594?

CVE-2026-78594 has a CVSS v3.1 base score of 4.9 (MEDIUM).

What are the technical details?

Original Advisory

Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.

Weaknesses (CWE)

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification): The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Source: MITRE CWE corpus.