Live › vulnerability › CVE-2026-81869
Go to dashboardOpenTelemetry-Go's SDK fails to enforce the attribute length limit for string attributes that contain the Unicode replacement character U+FFFD, so attacker-controlled span attributes can exceed the configured size. An attacker who controls span attribute content can inflate per-span memory use in the instrumented process, weakening denial-of-service protection.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| go.opentelemetry.io/otel/sdk | go | >= 1.10.0, < 1.33.0 | 1.33.0 |
Run go list -m go.opentelemetry.io/otel/sdk in the module and check whether the version is >= 1.10.0 and < 1.33.0.
Upgrade go.opentelemetry.io/otel/sdk to 1.33.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-81869")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.