Is CVE-2026-115716 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115716 being exploited in the wild.

How severe is CVE-2026-115716?

Medium severity, with a CVSS score of 6.5, published 3 November 2026.

Which products and versions are affected?

Elastic Apm Server 8.3.0 through 8.19.23; 9.0.0 through 9.4.8; 9.5.0 through 9.5.5.

Is there a fix for CVE-2026-115716?

Yes: fixed in APM Server 8.19.24, 9.4.9, 9.5.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115716 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115716?

Check whether you run Elastic Apm Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115716: Elastic APM Server denial of service via oversized OTLP payloads

CVE-2026-115716 · Severity: medium · CVSS 6.5 · Published 2026-11-03

Elastic APM Server, which collects and processes application performance monitoring data, is vulnerable to denial of service attacks through oversized data payloads sent over the HTTP OpenTelemetry protocol. An attacker with network access can send malicious requests that cause APM Server to consume excessive memory and crash, preventing legitimate monitoring data collection until the service is manually restarted.

Technologies: Elastic Apm Server. Vendors: Elastic.

Quick answers

Is CVE-2026-115716 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115716 being exploited in the wild.
How severe is CVE-2026-115716?: Medium severity, with a CVSS score of 6.5, published 3 November 2026.
Which products and versions are affected?: Elastic Apm Server 8.3.0 through 8.19.23; 9.0.0 through 9.4.8; 9.5.0 through 9.5.5.
Is there a fix for CVE-2026-115716?: Yes: fixed in APM Server 8.19.24, 9.4.9, 9.5.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115716 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115716?: Check whether you run Elastic Apm Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: APM Server 8.19.24, 9.4.9, 9.5.6

Technical details

The vulnerability is an uncontrolled resource allocation flaw (CWE-770) in APM Server's OpenTelemetry OTLP/HTTP intake handler. An authenticated or unauthenticated attacker can send HTTP requests containing decompressed payloads exceeding reasonable limits, causing unbounded memory consumption and out-of-memory termination. The fix enforces a 64 MiB maximum payload size limit after decompression, aligning with the OTLP specification.

Affected products

Elastic APM Server 8.3.0 through 8.19.23; 9.0.0 through 9.4.8; 9.5.0 through 9.5.5

Timeline

2026-11-03: disclosed

References

https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-236/391373

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.