apm_server vulnerabilities
CVEs whose affected-version data names the apm_server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-115289Medium· 4.3Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information Disclosure
Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration …
▾ SunlitElastic · APM ServerEPSS 0.24%via CVEORG
CVE-2026-115716Medium· 6.5Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service
Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can…
▾ SunlitElastic · APM ServerEPSS 0.35%via CVEORG