CVE-2026-115716
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Nov 3, 2026
CISA due date
—
The record
Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-116646 Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response. CWE-770
- CVE-2026-111751 Angular is a development platform for building mobile and desktop web applications using… CWE-770
- CVE-2026-63501 ag-psd is a JavaScript library for reading and writing Photoshop Document files. CWE-770
- CVE-2026-115715 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead… CWE-770
- CVE-2026-118487 In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in… CWE-770
- CVE-2026-108147 An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13… CWE-770
- CVE-2026-121412 FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption… CWE-770
- CVE-2026-121405 FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP… CWE-770