CVE-2026-115716

MediumCVSS 6.5/10Last modified Nov 3, 2026

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Elastic	APM Server	>= 8.3.0, <= 8.19.23; >= 9.0.0, <= 9.4.8; >= 9.5.0, <= 9.5.5

References

https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-236/391373

Timeline

Published: Nov 3, 2026
Last modified: Nov 3, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1157177.7Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks t CVE-2026-1157184.3Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any au CVE-2026-115728.8Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of CVE-2026-1157205.0Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard CVE-2026-1157217.5**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. CVE-2026-1157226.1RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list prope CVE-2026-1157237.4Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow CVE-2026-1157242.9VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based on CVE-2026-1157254.2Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by suppl CVE-2026-1157267.8Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider CVE-2026-1157278.1AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while CVE-2026-1157287.5@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an in