{"id":"CVE-2026-115716","kind":"vulnerability","aliases":["CVE-2026-115716"],"related":[],"title":"Elastic APM Server: oversized OTLP payloads can exhaust memory and stop intake","description":"Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.","summary":"APM Server accepts OpenTelemetry (OTLP) data over HTTP without limiting payload size. A sender can exhaust its memory and crash it, which stops telemetry intake until it restarts.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apm-server","elastic","infrastructure","observability","opentelemetry"],"not_affected_if":["otlp-http-not-exposed"],"how_to_check":"- Check the APM Server version with `apm-server version` and compare it against the affected range in the advisory.\n- Confirm whether the OTLP HTTP intake is exposed to untrusted senders (unknown if the sources do not say).","fix":null,"status":"open","published_at":"2026-11-03T17:17:56+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","triaged_at":"2026-11-03T17:24:13+00:00","updated_at":"2026-11-03T17:24:13+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-03T17:24:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Elastic APM Server: oversized OTLP payloads can exhaust memory and stop intake","impact":"low","summary":"APM Server accepts OpenTelemetry (OTLP) data over HTTP without limiting payload size. A sender can exhaust its memory and crash it, which stops telemetry intake until it restarts.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["apm-server","elastic","opentelemetry","observability"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"APM Server crashes from memory exhaustion, halting telemetry intake","analyst_note":"Check the NVD entry and Elastic's advisory for affected and fixed versions and whether the OTLP HTTP endpoint needs any setting enabled.","how_to_check":"- Check the APM Server version with `apm-server version` and compare it against the affected range in the advisory.\n- Confirm whether the OTLP HTTP intake is exposed to untrusted senders (unknown if the sources do not say).","plain_action":"","needs_analyst":true,"not_affected_if":["otlp-http-not-exposed"],"who_is_affected":"Teams running APM Server that accept OpenTelemetry data over HTTP from clients they do not fully control. Deployments where the OTLP HTTP endpoint is reachable only from trusted internal senders carry less exposure. The sources do not list affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":4170,"output_tokens":552,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115716':15A,18A '-2026':14A,17A '-231':78C '-770':62C 'accept':28B 'alloc':54C 'apm':2A,20B,26B,64C,88C,94C,107C,112C 'apm-serv':19B 'attack':80C 'capec':77C 'caus':93C 'crash':45B 'cve':13A,16A 'cwe':61C 'data':31B,75C,86C,110C 'denial':69C 'elast':1A,22B 'exhaust':8A,41B,97C 'http':33B,91C 'infrastructur':23B 'intak':12A,50B,105C 'lead':67C 'limit':35B,58C 'memori':9A,43B,99C 'observ':24B 'opentelemetri':25B,29B,84C,109C 'otlp':5A,30B,85C 'overs':4A,73C 'payload':6A,36B,76C 'resourc':56C 'restart':53B,114C 'send':83C 'sender':39B 'serial':74C 'server':3A,21B,27B,65C,89C,95C,113C 'servic':71C 'size':37B 'stop':11A,48B,103C 'telemetri':49B 'termin':101C 'throttl':60C 'via':72C 'without':34B,57C","nicknames":[],"mitigations":[],"who_affected":"Teams running APM Server that accept OpenTelemetry data over HTTP from clients they do not fully control. Deployments where the OTLP HTTP endpoint is reachable only from trusted internal senders carry less exposure. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apmserver","elastic","infrastructure","medium","observability","opentelemetry"],"first_public_at":"2026-11-03T17:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security@elastic.co","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115716","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115716","severity":null,"published_at":"2026-11-03T17:17:56+00:00","modified_at":"2026-11-03T17:17:56+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","fetched_at":"2026-11-03T17:21:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}