{"id":"CVE-2026-81869","kind":"vulnerability","aliases":["CVE-2026-81869","GHSA-p9f8-wvj8-2fg8","GO-2026-6616"],"related":[],"title":"OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation in go.opentelemetry.io/otel/sdk","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","summary":"OpenTelemetry-Go's SDK fails to enforce the attribute length limit for string attributes that contain the Unicode replacement character U+FFFD, so attacker-controlled span attributes can exceed the configured size. An attacker who controls span attribute content can inflate per-span memory use in the instrumented process, weakening denial-of-service protection.","severity":"medium","cvss":5.1,"epss":0.0018,"exploited":false,"exploited_at":null,"products":[{"name":"go.opentelemetry.io/otel/sdk","fixed":["1.33.0"],"affected":">= 1.10.0, < 1.33.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","observability","opentelemetry","package","self-hosted"],"not_affected_if":["attributes-not-attacker-controlled","version-1.33.0-or-later"],"how_to_check":"Run `go list -m go.opentelemetry.io/otel/sdk` in the module and check whether the version is >= 1.10.0 and < 1.33.0.","fix":"Upgrade go.opentelemetry.io/otel/sdk to 1.33.0 or later.","status":"open","published_at":"2026-09-16T21:17:22+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:49:04+00:00","updated_at":"2026-10-23T21:49:04+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:49:04Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade go.opentelemetry.io/otel/sdk to 1.33.0 or later.\nunknown","reach":"unknown","impact":"low","summary":"OpenTelemetry-Go's SDK fails to enforce the attribute length limit for string attributes that contain the Unicode replacement character U+FFFD, so attacker-controlled span attributes can exceed the configured size. An attacker who controls span attribute content can inflate per-span memory use in the instrumented process, weakening denial-of-service protection.","category":"package","who_cares":["go","opentelemetry","observability","self-hosted"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Oversized span attributes retained, increasing memory use and weakening DoS protection","analyst_note":"","how_to_check":"Run `go list -m go.opentelemetry.io/otel/sdk` in the module and check whether the version is >= 1.10.0 and < 1.33.0.\nunknown\nunknown","needs_analyst":false,"not_affected_if":["version-1.33.0-or-later","attributes-not-attacker-controlled"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000523,"input_tokens":3118,"output_tokens":423,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,25A,28A '-6616':26A '-8':5A,146C '-81869':18A,29A '/otel/sdk':15A,32A '1.10.0':109C '1.33.0':111C,208C '2fg8':23A 'also':165C 'attack':65B,75B,171C 'attacker-control':64B 'attempt':163C 'attribut':9A,49B,54B,68B,79B,114C,128C,175C 'attributevaluelengthlimit':121C 'bypass':8A 'charact':60B,134C 'configur':72B,183C 'contain':56B,129C 'content':80B,176C 'control':66B,77B,173C 'cve':16A,27A 'denial':94B,194C 'denial-of-servic':93B,193C 'enforc':47B,120C 'exceed':70B 'fail':45B,118C 'fffd':62B,136C 'fix':205C 'ghsa':20A 'ghsa-p9f8-wvj8-2fg8':19A 'go':3A,24A,33B,42B,100C,103C 'go.opentelemetry.io':14A,31A 'go.opentelemetry.io/otel/sdk':13A,30A 'host':39B 'implement':104C 'increas':185C 'inflat':82B 'input':151C 'instrument':90B,200C 'invalid':144C 'issu':203C 'leav':154C 'length':10A,50B 'limit':51B,184C 'longer':180C 'memori':86B,189C 'observ':34B 'opentelemetri':2A,35B,41B,99C,106C 'opentelemetry-go':1A,40B,98C 'origin':150C 'overs':168C 'p9f8':21A 'packag':36B 'path':116C 'per':84B,187C 'per-span':83B,186C 'process':91B,201C 'protect':97B,197C 'replac':6A,59B,133C,141C 'retain':178C 'return':148C,166C 'rune':7A,142C,157C 'safetrunc':162C 'safetruncatevalidutf8':137C 'sdk':44B 'sdk/trace/span.go':113C 'second':161C 'self':38B 'self-host':37B 'servic':96B,196C 'size':73B 'slice':127C 'span':67B,78B,85B,174C,188C 'string':53B,123C,126C 'string-slic':125C 'strings.tovalidutf8':153C 'treat':138C 'truncat':11A,115C 'u':61B,135C 'unchang':158C 'unicod':58B,132C 'use':87B,190C 'utf':4A,145C 'valid':131C,140C,156C 'valu':169C,179C 'version':108C,207C 'weaken':92B,192C 'wvj8':22A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-16T21:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6616","url":"https://pkg.go.dev/vuln/GO-2026-6616","severity":null,"published_at":"2026-10-01T20:24:10+00:00","modified_at":"2026-10-01T20:24:10+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-81869","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81869","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-81869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81869","severity":null,"published_at":"2026-09-16T21:17:22+00:00","modified_at":"2026-09-30T17:43:24+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}