APM Server vulnerabilities

APM Server has a CWE-770 (allocation of resources without limits or throttling) vulnerability enabling denial of service via oversized serialized data payloads. An attacker able to send OpenTelemetry (OTLP) data over HTTP can cause memory exhaustion and server termination.

Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.

Improper handling of highly compressed data in APM Server can lead to persistent denial of service. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts memory when processed, terminating the process. The condition recurs on every restart until the stored content is removed.