CVE-2026-115716
MediumCVSS 6.5Summary
APM Server has a CWE-770 (allocation of resources without limits or throttling) vulnerability enabling denial of service via oversized serialized data payloads. An attacker able to send OpenTelemetry (OTLP) data over HTTP can cause memory exhaustion and server termination.
Risk Assessment
An attacker can stop the intake of APM and OpenTelemetry data until the server restarts, causing loss of monitoring visibility. This may disrupt incident detection and observability continuity.
Recommendation
Update APM Server to a version containing the fix. Consider limiting the size of OTLP payloads and controlling access to the HTTP endpoint.
Other vulnerabilities in APM Server
See all- CVE-2026-115289Medium
Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.
- CVE-2026-78594Medium
Improper handling of highly compressed data in APM Server can lead to persistent denial of service. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts memory when processed, terminating the process. The condition recurs on every restart until the stored content is removed.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS