OpenTelemetry Go Truncation Vulnerability Affects Attribute Management

CVE-2026-81869

What is CVE-2026-81869?

The OpenTelemetry-Go SDK contains a vulnerability in the attribute truncation logic within the sdk/trace/span.go file that impacts versions from 1.10.0 to 1.33.0. Specifically, the handling of the Unicode replacement character U+FFFD may not enforce the defined AttributeValueLengthLimit for string and string-slice attributes. This oversight allows the potential for an attacker, who has control over span attribute content, to exceed the configured attribute length limits. As a result, this can lead to increased memory consumption per-span and weaken the application’s denial-of-service protections. The issue has been addressed in version 1.33.0.

References