Denial of Service Vulnerability in APM Server by Elastic

CVE-2026-115716

What is CVE-2026-115716?

The APM Server by Elastic is susceptible to a Denial of Service attack due to inadequate resource allocation handling. Attackers can exploit this vulnerability by sending oversized serialized data payloads through OpenTelemetry (OTLP) data to the server. This can lead to the server exhausting its memory resources, ultimately causing the APM Server to crash and halt the intake of critical APM and OpenTelemetry data until the server is restarted.

References