Vulnerability · Published Nov 3, 2026 · Assigned by elastic
CVE-2026-115716Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service
Medium 6.5
In plain English
A medium-severity resource allocation without limits in APM Server from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elastic | APM Server | 8.3.0 – through 8.19.239.0.0 – through 9.4.89.5.0 – through 9.5.5 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H