Elastic APM Server CVE-2026-115716

The attacker must be able to send OpenTelemetry (OTLP) data to APM Server over HTTP - i.e., network reachability to the APM Server OTLP/HTTP intake endpoint - and the CVSS PR:L metric indicates some privilege/authentication level is required to submit that data (authentication requirements beyond PR:L are not detailed in the available sources). The specific trigger is an oversized serialized OTLP payload that APM Server allocates without throttling. Limiting factors: this affects only deployments exposing the OTLP/HTTP intake, exploitation needs the PR:L privilege rather than being fully anonymous, and impact is confined to availability (service crash/restart) with no confidentiality or integrity effect; the vulnerable-versions boundary should be confirmed against ESA-2026-236.

This is a moderate-severity availability-only flaw (CVSS 6.5, vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), not a top-priority emergency. The signals are internally consistent: the vector scores confidentiality and integrity as None and only availability as High, matching the CWE-770 resource-exhaustion description where an oversized OTLP payload exhausts APM Server memory and forces a terminate/restart. The PR:L metric indicates exploitation requires some privilege level, so this is not an unauthenticated internet-wide crash. The vuln.today decision label is 'this_month' (routine patch cadence), consistent with a DoS that has no code-execution or data-disclosure impact. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the supplied data - the only reference is the vendor security advisory (ESA-2026-236). Exploitation status: no public exploit identified at time of analysis. Net: a real but bounded operational-availability issue affecting the APM/OTLP intake pipeline, worth scheduled patching rather than crisis response. EPSS is absent (not an error) so probabilistic exploitation likelihood cannot be quantified from this data.

An attacker with the ability to reach APM Server's OTLP-over-HTTP intake endpoint sends a crafted, oversized serialized data payload that APM Server allocates without limit, exhausting its memory and causing the process to terminate. The outage halts ingestion of all APM and OpenTelemetry data until APM Server is restarted. The CVSS PR:L metric indicates the attacker needs some privilege level to reach/submit to the intake, and no public exploit code was identified in the supplied data.