CVE-2026-115716

Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.

• CWE-770

• https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-236/391373

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-115710Use of Cache Containing Sensitive Information (CWE-524) in E…4.2
• CVE-2026-115711Insertion of Sensitive Information into Externally-Accessibl…6.4
• CVE-2026-115712Incorrect Authorization (CWE-863) in Elastic Cloud Enterpris…4.3
• CVE-2026-115713Improper Link Resolution Before File Access ('Link Following…7.5
• CVE-2026-115714Improper Certificate Validation (CWE-295) in the operating s…7.4
• CVE-2026-115715Allocation of Resources Without Limits or Throttling (CWE-77…6.5
• CVE-2026-115717Frappe Builder versions before 1.36.1 contain a server-side …7.7
• CVE-2026-115718Frappe Builder versions 1.33.0 before1.36.0 contain a missin…4.3
• CVE-2026-11572Versions of the package degit before 2.8.6, from 3.0.0 and b…8.8
• CVE-2026-115720Frappe Builder before 1.36.1 contains a server-side request …5
• CVE-2026-115721**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML p…7.5
• CVE-2026-115722RPly through 1.1.4 contains an improper array index validati…6.1