CVE-2026-81869: OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
The OpenTelemetry Go SDK trace package can fail to enforce AttributeValueLengthLimit for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured memory/DoS protection and allowing increased per-span memory usage. The finding is low severity because it requires a deployment with attribute value length limits enabled and attacker-controlled data being recorded into span attributes.
Introduced in commit 49a6536
References
- github.com/advisories/GHSA-p9f8-wvj8-2fg8
- github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a
- github.com/open-telemetry/opentelemetry-go/issues/5996
- github.com/open-telemetry/opentelemetry-go/pull/5997
- github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.33.0
- github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8
- nvd.nist.gov/vuln/detail/CVE-2026-81869
Code Behaviors & Features
Detect and mitigate CVE-2026-81869 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →