CVE-2024-11994: Elastic APM Server

Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days.

APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclose sensitive information in APM Server error logs.

Affected products

• Elastic APM Server: from 8.0.0, before 8.16.1 (fixed in 8.16.1)

Published 2025-05-01. Last modified 2026-06-17.