Live › vulnerability › CVE-2026-115716
APM Server accepts OpenTelemetry (OTLP) data over HTTP without limiting payload size. A sender can exhaust its memory and crash it, which stops telemetry intake until it restarts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Teams running APM Server that accept OpenTelemetry data over HTTP from clients they do not fully control. Deployments where the OTLP HTTP endpoint is reachable only from trusted internal senders carry less exposure. The sources do not list affected versions.
No product ranges from the sources yet.
apm-server version and compare it against the affected range in the advisory.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.
This page as .md · .json · in your agent: get_signal("CVE-2026-115716")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.