---
id: "CVE-2026-115716"
kind: "vulnerability"
aliases: ["CVE-2026-115716"]
title: "Elastic APM Server: oversized OTLP payloads can exhaust memory and stop intake"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["apm-server", "elastic", "infrastructure", "observability", "opentelemetry"]
not_affected_if: ["otlp-http-not-exposed"]
published_at: "2026-11-03T17:17:56+00:00"
first_seen_at: "2026-11-03T17:21:55+00:00"
updated_at: "2026-11-03T17:24:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115716", "first_seen_at": "2026-11-03T17:21:55+00:00"}]
---

# Elastic APM Server: oversized OTLP payloads can exhaust memory and stop intake

APM Server accepts OpenTelemetry (OTLP) data over HTTP without limiting payload size. A sender can exhaust its memory and crash it, which stops telemetry intake until it restarts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the APM Server version with `apm-server version` and compare it against the affected range in the advisory.
- Confirm whether the OTLP HTTP intake is exposed to untrusted senders (unknown if the sources do not say).

## Timeline

- 2026-11-03T17:21:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115716

## From the sources

Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_