---
id: CVE-2026-115716
title: >-
  Allocation of Resources Without Limits or Throttling in APM Server Leading to
  Denial of Service
summary: >-
  Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server
  can lead to denial of service via Oversized Serialized Data Payloads
  (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server
  over HTTP can…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-770
vendor: Elastic
product: APM Server
affected:
  - apm_server >= 8.3.0 <= 8.19.23
  - apm_server >= 9.0.0 <= 9.4.8
  - apm_server >= 9.5.0 <= 9.5.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:28:55.118555Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T17:29:02.326Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115716'
references:
  - url: >-
      https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-236/391373
tags:
  - cve.org
epss: 0.00352
epssPercentile: 0.29043
ingestedAt: '2026-11-05T20:33:06.318Z'
---

## Overview

Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.

## Affected

- `apm_server >= 8.3.0 <= 8.19.23`
- `apm_server >= 9.0.0 <= 9.4.8`
- `apm_server >= 9.5.0 <= 9.5.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.