CVE-2026-81869

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions 1.10.0 through 1.32.0

Description The attribute truncation path in sdk/trace/span.go fails to enforce the AttributeValueLengthLimit for string and string-slice attributes that contain the Unicode replacement character U+FFFD. This occurs because the safeTruncateValidUTF8 function treats the replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves the rune unchanged, allowing oversized values to persist. An attacker controlling span attribute content can bypass configured limits, leading to increased per-span memory consumption and weakening denial-of-service protections in the instrumented process.

Recommendations Update to version 1.33.0.