{"id":"CVE-2026-81869","aliases":["AZL-103073","AZL-103131","AZL-103143","AZL-103149","AZL-103155","AZL-103161","AZL-103170","AZL-103179","AZL-103191","AZL-103221","AZL-103233","AZL-103239","AZL-103245","AZL-103248","AZL-103257","DEBIAN-CVE-2026-81869","EUVD-2026-81260","GHSA-p9f8-wvj8-2fg8","GO-2026-6616","UBUNTU-CVE-2026-81869"],"status":"published","title":"OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0018,"percentile":0.07653,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-176","CWE-400"],"published":"2026-09-16T20:41:15Z","modified":"2026-11-06T14:16:30Z","fixes":[{"ecosystem":"Go","package":"go.opentelemetry.io/otel/sdk","fixed_in":["1.33.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"cert-manager","fixed_in":["1.12.15-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-compose","fixed_in":["2.27.0-15"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"flannel","fixed_in":["0.24.2-33"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kube-vip-cloud-provider","fixed_in":["0.0.10-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"moby-containerd-cc","fixed_in":["1.7.7-18"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"moby-engine","fixed_in":["25.0.18-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"opa","fixed_in":["0.63.0-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-opentelemetry-otel","fixed_in":["1.43.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"go.opentelemetry.io/otel/sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.33.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cloud-provider-kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.5.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.15-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.32.0-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.14.0-17"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-compose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"flannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.2-33"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.15.0.aks0-21"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"keda","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.14.1-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.10-32"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kube-vip-cloud-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.10-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-containerd-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-18"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.18-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"opa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63.0-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"prometheus-adapter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.12.0-12"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-opentelemetry-otel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.31.0-4","1.31.0-5","1.31.0-6","1.43.0-1","1.43.0-2","1.43.0-3","1.43.0-4","1.46.0-1~exp1","1.46.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-opentelemetry-otel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-1"}]}],"versions":["1.31.0-4","1.31.0-5","1.31.0-6"]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/otel/sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"1.10.0"},{"fixed":"1.33.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/otel/sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"1.10.0"},{"fixed":"1.33.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-opentelemetry-otel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-opentelemetry-otel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-opentelemetry-otel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.31.0-6","1.43.0-4build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-opentelemetry-otel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.31.0-4","1.31.0-5","1.31.0-6"]}],"products":[{"vendor":"open-telemetry","product":"opentelemetry-go"}],"references":[{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8","tags":["x_refsource_CONFIRM","exploit","advisory","web","report"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/issues/5996","tags":["x_refsource_MISC","report","web"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/pull/5997","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.33.0","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81869","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-p9f8-wvj8-2fg8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81869.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-81869","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-go","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-81869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81869","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-81869","title":"OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T20:41:15.806Z","modified":"2026-09-17T14:15:51.501Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-176","CWE-400"],"updated_at":"2026-11-02T13:36:18.075535Z"}],"euvd":[{"id":"EUVD-2026-81260","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T20:41:15Z","modified":"2026-09-17T14:15:51Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:28:12.076337Z"}],"ghsa":[{"id":"GHSA-p9f8-wvj8-2fg8","title":"OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation","description":"### Summary\n\nThe OpenTelemetry Go SDK trace package can fail to enforce `AttributeValueLengthLimit` for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured memory/DoS protection and allowing increased per-span memory usage. The finding is low severity because it requires a deployment with attribute value length limits enabled and attacker-controlled data being recorded into span attributes.\n\nIntroduced in commit 49a6536\n\n### Details\n\nString and string-slice span attributes are truncated through `safeTruncate` when `AttributeValueLengthLimit` is non-negative. The finding evidence identifies this enforcement path in `sdk/trace/span.go:303-331`, with string attributes passed to `safeTruncate` at `sdk/trace/span.go:309-310` and string-slice entries passed to `safeTruncate` in the loop beginning at `sdk/trace/span.go:312`.\n\n`safeTruncate` first calls `safeTruncateValidUTF8`; if that returns `ok=false`, it calls `strings.ToValidUTF8(input, \"\")` and retries. The relevant code is identified in `sdk/trace/span.go:337-355`. `safeTruncateValidUTF8` treats any `utf8.RuneError` from `utf8.DecodeRuneInString` as invalid UTF-8 and immediately returns the original input with `ok=false`. However, Go also returns `utf8.RuneError` for a valid encoded U+FFFD rune. The validation artifact confirms this behavior with output `r=U+FFFD size=3 runeError=true`.\n\nFor an input such as `\"AAAA\" + U+FFFD + strings.Repeat(\"B\", 20)` and a limit of 5, the first truncation attempt sees U+FFFD as `utf8.RuneError` and returns the full input with `ok=false`. `strings.ToValidUTF8` does not remove the valid U+FFFD rune, so the second attempt returns the same full input. As a result, the span attribute value remains 27 bytes long even though the configured limit is 5.\n\n### PoC\n\n[validation-artifact.zip](https://github.com/user-attachments/files/27494267/validation-artifact.zip)\n\n\nThe validation artifact contains a package-level Go test at `validation-artifact.tar:safe_truncate_bypass/safe_truncate_poc_test.go` and supporting output at `validation-artifact.tar:safe_truncate_bypass/runecheck_output.txt`.\n\nReproduction configuration:\n- Repository: `pellared/opentelemetry-go`\n- Commit: `49a6536` from September 12, 2022\n- Package/module path: `sdk/trace` under the `sdk` module\n- Attribute value length limit used by the PoC: `limit := 5`\n- Dependencies must be available through the network or a local module cache/vendor directory.\n\nCommands:\n```sh\ncd /path/to/opentelemetry-go\ngit checkout 49a6536\ntar -xOf /path/to/validation-artifact.tar safe_truncate_bypass/safe_truncate_poc_test.go \u003e sdk/trace/safe_truncate_poc_test.go\ncd sdk\ngo test ./trace -run TestSafeTruncateBypass -count=1 -v\n```\n\nExpected vulnerable output includes a failing test showing that the returned value exceeds the configured limit:\n```text\n=== RUN   TestSafeTruncateBypass\n    safe_truncate_poc_test.go:14: input_len=27 got_len=27 input=\"AAAA�BBBBBBBBBBBBBBBBBBBB\" got=\"AAAA�BBBBBBBBBBBBBBBBBBBB\"\n    safe_truncate_poc_test.go:16: bypass: got_len 27 \u003e limit 5\n--- FAIL: TestSafeTruncateBypass\n```\n\nThe artifact also records the standalone UTF-8 behavior needed for the bypass:\n```sh\ntar -xOf /path/to/validation-artifact.tar safe_truncate_bypass/runecheck_output.txt\n```\n\nExpected output:\n```text\nr=U+FFFD size=3 runeError=true\n```\n\n### Impact\n\nThis is a Unicode handling and resource-limit bypass that weakens span attribute memory controls. Applications that enable `AttributeValueLengthLimit` to bound memory usage can still store oversized attacker-controlled attribute values if those values contain U+FFFD. The practical impact is increased memory use and reduced denial-of-service protection in the instrumented process; the finding does not show confidentiality or integrity impact.","status":"published","published":"2026-09-29T17:59:10Z","modified":"2026-09-29T17:59:11Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-176","CWE-400"],"updated_at":"2026-11-02T14:41:22.654187Z"}],"nvd":[{"id":"CVE-2026-81869","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22.18Z","modified":"2026-09-30T17:43:24.057Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-176","CWE-400"],"updated_at":"2026-11-02T14:12:49.013904Z"}],"osv":[{"id":"CVE-2026-81869","title":"OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T20:41:15.806Z","modified":"2026-10-28T02:30:32.846577952Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-176","CWE-400"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"DEBIAN-CVE-2026-81869","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22.18Z","modified":"2026-10-04T00:00:12.375378488Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"GHSA-p9f8-wvj8-2fg8","title":"OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation","description":"### Summary\n\nThe OpenTelemetry Go SDK trace package can fail to enforce `AttributeValueLengthLimit` for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured memory/DoS protection and allowing increased per-span memory usage. The finding is low severity because it requires a deployment with attribute value length limits enabled and attacker-controlled data being recorded into span attributes.\n\nIntroduced in commit 49a6536\n\n### Details\n\nString and string-slice span attributes are truncated through `safeTruncate` when `AttributeValueLengthLimit` is non-negative. The finding evidence identifies this enforcement path in `sdk/trace/span.go:303-331`, with string attributes passed to `safeTruncate` at `sdk/trace/span.go:309-310` and string-slice entries passed to `safeTruncate` in the loop beginning at `sdk/trace/span.go:312`.\n\n`safeTruncate` first calls `safeTruncateValidUTF8`; if that returns `ok=false`, it calls `strings.ToValidUTF8(input, \"\")` and retries. The relevant code is identified in `sdk/trace/span.go:337-355`. `safeTruncateValidUTF8` treats any `utf8.RuneError` from `utf8.DecodeRuneInString` as invalid UTF-8 and immediately returns the original input with `ok=false`. However, Go also returns `utf8.RuneError` for a valid encoded U+FFFD rune. The validation artifact confirms this behavior with output `r=U+FFFD size=3 runeError=true`.\n\nFor an input such as `\"AAAA\" + U+FFFD + strings.Repeat(\"B\", 20)` and a limit of 5, the first truncation attempt sees U+FFFD as `utf8.RuneError` and returns the full input with `ok=false`. `strings.ToValidUTF8` does not remove the valid U+FFFD rune, so the second attempt returns the same full input. As a result, the span attribute value remains 27 bytes long even though the configured limit is 5.\n\n### PoC\n\n[validation-artifact.zip](https://github.com/user-attachments/files/27494267/validation-artifact.zip)\n\n\nThe validation artifact contains a package-level Go test at `validation-artifact.tar:safe_truncate_bypass/safe_truncate_poc_test.go` and supporting output at `validation-artifact.tar:safe_truncate_bypass/runecheck_output.txt`.\n\nReproduction configuration:\n- Repository: `pellared/opentelemetry-go`\n- Commit: `49a6536` from September 12, 2022\n- Package/module path: `sdk/trace` under the `sdk` module\n- Attribute value length limit used by the PoC: `limit := 5`\n- Dependencies must be available through the network or a local module cache/vendor directory.\n\nCommands:\n```sh\ncd /path/to/opentelemetry-go\ngit checkout 49a6536\ntar -xOf /path/to/validation-artifact.tar safe_truncate_bypass/safe_truncate_poc_test.go \u003e sdk/trace/safe_truncate_poc_test.go\ncd sdk\ngo test ./trace -run TestSafeTruncateBypass -count=1 -v\n```\n\nExpected vulnerable output includes a failing test showing that the returned value exceeds the configured limit:\n```text\n=== RUN   TestSafeTruncateBypass\n    safe_truncate_poc_test.go:14: input_len=27 got_len=27 input=\"AAAA�BBBBBBBBBBBBBBBBBBBB\" got=\"AAAA�BBBBBBBBBBBBBBBBBBBB\"\n    safe_truncate_poc_test.go:16: bypass: got_len 27 \u003e limit 5\n--- FAIL: TestSafeTruncateBypass\n```\n\nThe artifact also records the standalone UTF-8 behavior needed for the bypass:\n```sh\ntar -xOf /path/to/validation-artifact.tar safe_truncate_bypass/runecheck_output.txt\n```\n\nExpected output:\n```text\nr=U+FFFD size=3 runeError=true\n```\n\n### Impact\n\nThis is a Unicode handling and resource-limit bypass that weakens span attribute memory controls. Applications that enable `AttributeValueLengthLimit` to bound memory usage can still store oversized attacker-controlled attribute values if those values contain U+FFFD. The practical impact is increased memory use and reduced denial-of-service protection in the instrumented process; the finding does not show confidentiality or integrity impact.","status":"published","published":"2026-09-29T17:59:10Z","modified":"2026-10-01T20:56:23.877100823Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-176","CWE-400"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"UBUNTU-CVE-2026-81869","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:00Z","modified":"2026-10-17T13:01:10.626105907Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"AZL-103073","title":"CVE-2026-81869 affecting package cri-o 1.30.1-1","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103131","title":"CVE-2026-81869 affecting package cloud-provider-kubevirt 0.5.1-10","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103143","title":"CVE-2026-81869 affecting package cert-manager for versions less than 1.12.15-14","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-09-23T14:17:16.226648831Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"AZL-103149","title":"CVE-2026-81869 affecting package cri-tools 1.32.0-10","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103155","title":"CVE-2026-81869 affecting package docker-buildx 0.14.0-17","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"AZL-103161","title":"CVE-2026-81869 affecting package docker-compose for versions less than 2.27.0-15","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-11-02T14:15:31.488441588Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"AZL-103170","title":"CVE-2026-81869 affecting package flannel for versions less than 0.24.2-33","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-11-02T14:15:39.500593764Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"AZL-103179","title":"CVE-2026-81869 affecting package kata-containers-cc 3.15.0.aks0-21","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"AZL-103191","title":"CVE-2026-81869 affecting package keda 2.14.1-19","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-10-31T05:32:45Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"AZL-103221","title":"CVE-2026-81869 affecting package kubernetes 1.30.10-32","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103233","title":"CVE-2026-81869 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-09-23T14:16:12.996120403Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"AZL-103239","title":"CVE-2026-81869 affecting package moby-containerd-cc for versions less than 1.7.7-18","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103245","title":"CVE-2026-81869 affecting package moby-engine for versions less than 25.0.18-1","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-11-02T14:15:40.188999438Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"AZL-103248","title":"CVE-2026-81869 affecting package opa for versions less than 0.63.0-6","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-11-06T14:16:30.043260029Z","updated_at":"2026-11-06T14:57:15.495576Z"},{"id":"AZL-103257","title":"CVE-2026-81869 affecting package prometheus-adapter 0.12.0-12","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","status":"published","published":"2026-09-16T21:17:22Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"GO-2026-6616","title":"OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation in go.opentelemetry.io/otel/sdk","description":"OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation in go.opentelemetry.io/otel/sdk","status":"published","published":"2026-10-01T20:24:10Z","modified":"2026-10-01T20:45:17.224166882Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}