# CVE-2026-115716: Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service

> CVE-2026-115716: Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-115716
Last updated: 2026-11-03T20:32:50Z

- Published: 2026-11-03 16:44 UTC · Updated: 2026-11-03 20:32 UTC · Assigner: elastic
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS: 0.35%, 29th percentile (scored 2026-11-10)
- CISA KEV: no
- CWE: CWE-770

## Description

Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.

## Affected vendors and products

- Elastic: APM Server

## Tracked companies

- [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-115716)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-115716)
- [https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-236/391373](https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-236/391373)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-115716 · Markdown: https://rewindex.com/cve/CVE-2026-115716.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-115716 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-11T05:26:46.432Z