CVE-2026-81869: OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
The OpenTelemetry Go SDK trace package can fail to enforce AttributeValueLengthLimit for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured memory/DoS protection and allowing increased per-span memory usage. The finding is low severity because it requires a deployment with attribute value length limits enabled and attacker-controlled data being recorded into span attributes.
Introduced in commit 49a6536
References
- github.com/advisories/GHSA-p9f8-wvj8-2fg8
- github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a
- github.com/open-telemetry/opentelemetry-go/issues/5996
- github.com/open-telemetry/opentelemetry-go/pull/5997
- github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.33.0
- github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8
- nvd.nist.gov/vuln/detail/CVE-2026-81869
Code Behaviors & Features
Detect and mitigate CVE-2026-81869 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →