CVE-2026-115716: APM Server: OTLP memory exhaustion causes DoS

MEDIUM

Published November 3, 2026

CISO Take

Elastic APM Server has an unbounded-allocation flaw (CWE-770) in its OpenTelemetry HTTP intake: an authenticated low-privilege sender can submit oversized serialized payloads that exhaust memory and crash the process. The result is a loss of APM and OpenTelemetry intake until the service is restarted, which blinds observability for AI/ML services that report through it. Exploitation needs only network access and low privileges. Severity is medium (CVSS 6.5, availability-only), and there is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so there is no evidence of active exploitation. Upgrade to APM Server 8.19.24, 9.4.9 or 9.5.6 per Elastic advisory ESA-2026-236, and restrict OTLP intake to trusted networks and collectors.

Sources:NVDdiscuss.elastic.coATLAS

What is the risk?

Medium risk. The attack is network-reachable, low complexity, needs low privileges (a valid APM secret token or API key, or an open intake endpoint) and no user interaction. Impact is limited to availability: no confidentiality or integrity loss. Exposure is highest where the OTLP HTTP endpoint is reachable from broad networks or where intake auth is disabled. There is no known exploitation, no public PoC and no EPSS score, so near-term likelihood is low to moderate, but the attack is trivial to script once the advisory details are studied.

How does the attack unfold?

Initial Access

Attacker reaches the APM Server OTLP HTTP intake endpoint over the network using low-privilege credentials or an unauthenticated endpoint.

AML.T0049

Exploitation

Attacker sends oversized serialized OTLP payloads that APM Server allocates without limits or throttling.

AML.T0029

Impact

APM Server exhausts memory and terminates, halting APM and OpenTelemetry intake until restart, blinding AI service monitoring.

AML.T0029

Initial Access

Attacker reaches the APM Server OTLP HTTP intake endpoint over the network using low-privilege credentials or an unauthenticated endpoint.

AML.T0049

Exploitation

Attacker sends oversized serialized OTLP payloads that APM Server allocates without limits or throttling.

AML.T0029

Impact

APM Server exhausts memory and terminates, halting APM and OpenTelemetry intake until restart, blinding AI service monitoring.

AML.T0029

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade APM Server to 8.19.24, 9.4.9 or 9.5.6 (or later) per ESA-2026-236. 2) Restrict network access to the OTLP HTTP intake port to known collectors or services using firewall rules or network policies, and put the endpoint behind a gateway with request-body size limits. 3) Require authentication (secret token or API keys) and rotate any credentials that may be broadly shared. 4) Set container or cgroup memory limits with automatic restart and alerting on OOM kills. 5) Use OpenTelemetry Collectors with buffering and retry in front of APM Server so telemetry survives short outages. 6) Detect abuse by monitoring for abnormally large OTLP requests, sudden memory growth and repeated APM Server restarts.

How is it classified?

DoSAPIFrameworkAML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 4.1-Post-deployment AI system monitoring plans are implemented

Frequently Asked Questions

What is CVE-2026-115716?

Is CVE-2026-115716 actively exploited?

No confirmed active exploitation of CVE-2026-115716 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-115716?

1) Upgrade APM Server to 8.19.24, 9.4.9 or 9.5.6 (or later) per ESA-2026-236. 2) Restrict network access to the OTLP HTTP intake port to known collectors or services using firewall rules or network policies, and put the endpoint behind a gateway with request-body size limits. 3) Require authentication (secret token or API keys) and rotate any credentials that may be broadly shared. 4) Set container or cgroup memory limits with automatic restart and alerting on OOM kills. 5) Use OpenTelemetry Collectors with buffering and retry in front of APM Server so telemetry survives short outages. 6) Detect abuse by monitoring for abnormally large OTLP requests, sudden memory growth and repeated APM Server restarts.

What systems are affected by CVE-2026-115716?

This vulnerability affects the following AI/ML architecture patterns: Observability and telemetry pipelines for AI/ML services, LLM application monitoring (OpenTelemetry instrumentation), Model serving and inference monitoring, Agent frameworks with tracing.

What is the CVSS score for CVE-2026-115716?

CVE-2026-115716 has a CVSS v3.1 base score of 6.5 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

Observability and telemetry pipelines for AI/ML servicesLLM application monitoring (OpenTelemetry instrumentation)Model serving and inference monitoringAgent frameworks with tracing

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.

Exploitation Scenario

An attacker or compromised workload with a low-privilege APM credential, or access to an unauthenticated intake endpoint, sends repeated HTTP requests to the OTLP intake path containing oversized serialized payloads. APM Server allocates memory without limits and is terminated by the OOM killer. While the service is down, the attacker carries out other activity against the organization's AI services, such as abusing an LLM API or agent tools, with reduced monitoring and delayed detection. Repeating the attack after each restart keeps observability degraded.

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or Throttling CWE-770Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.