This vulnerability occurs when the Elastic APM Server allocates memory for incoming OpenTelemetry (OTLP) payloads without applying any limits or throttling. An attacker can send oversized serialized data payloads over HTTP, which exhausts the server’s memory and causes it to terminate. The result is a loss of availability, preventing APM and OpenTelemetry data from being ingested until the server is restarted. The weakness is a classic resource exhaustion flaw, classified as CWE‑770.

The issue affects Elastic APM Server instances of any version that accept OpenTelemetry data over HTTP. Specific version numbers are not listed in the advisory, so all deployed instances should be evaluated.

The CVSS score of 6.5 indicates a medium severity, and no EPSS or KEV status is available, implying the exploit potential is undefined but not currently known to be actively used. The attack vector requires the attacker to be able to send data to the APM Server, which could be over an internal network or via exposed HTTP endpoints. If an attacker can reach the ingestion API, memory exhaustion can be triggered, leading to a server crash and denial of service. No specific authentication or privilege conditions are mentioned, so the risk is largely limited to the reachability of the ingestion endpoint.