CVE-2026-81869: OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenTelemetry-Goto a version that resolves this vulnerability.Fixed in 1.33.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instrumented Go processes using OpenTelemetry-Go versions 1.10.0 through versions before 1.33.0 are exposed if they configure AttributeValueLengthLimit and process span string or string-slice attribute values containing U+FFFD.
What must an attacker control to exploit the issue?
An attacker needs to be able to influence span attribute content so that an oversized string or string-slice value includes the valid Unicode replacement character U+FFFD. This can cause the configured attribute length limit not to be enforced.
Are deployments without an attribute value length limit affected?
The described bypass affects enforcement of AttributeValueLengthLimit. The provided information does not indicate an impact where that limit is not configured.
What is the remediation?
Upgrade OpenTelemetry-Go to version 1.33.0, which fixes the truncation behavior. If upgrading is not immediately possible, prevent untrusted input from being used directly as span attribute values and constrain attribute value sizes before they reach OpenTelemetry instrumentation.