CVE-2026-81869 in OpenTelemetry
Summary
by MITRE • 09/16/2026
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified within OpenTelemetry-Go versions ranging from 1.10.0 to 1.33.0 represents a critical failure in input validation and resource management logic, specifically concerning the handling of Unicode characters during attribute truncation operations. This flaw is rooted in the interaction between two specific functions: safeTruncateValidUTF8 and strings.ToValidUTF8. The core technical issue arises when span attributes contain string or string-slice values that include the valid Unicode replacement character U+FFFD. In standard UTF-8 encoding, this character serves as a placeholder for invalid sequences but is itself a perfectly valid rune. However, the implementation of safeTruncateValidUTF8 incorrectly classifies this specific valid rune as an invalid UTF-8 sequence. Consequently, instead of processing or truncating the string according to configured limits, the function returns the original input unchanged. This misclassification creates a logical bypass in the security controls designed to enforce attribute size constraints.
The operational impact of this flaw is significant for systems relying on OpenTelemetry for distributed tracing and observability. When an attacker gains control over span attribute content, they can exploit this logic error by embedding multiple instances of the U+FFFD character within their data payloads. Because safeTruncateValidUTF8 fails to truncate these values due to its erroneous classification, a subsequent attempt using strings.ToValidUTF8 also leaves the replacement rune unchanged. This results in oversized attribute values being retained rather than truncated to fit within the configured AttributeValueLengthLimit. The immediate consequence is an increase in per-span memory consumption on the instrumented process. In high-throughput environments where telemetry data is generated at scale, this unbounded growth can lead to substantial resource exhaustion, effectively undermining the denial-of-service protections intended by the length limits.
From a threat modeling perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write and CWE-400: Uncontrolled Resource Consumption. The failure to enforce size limits allows for uncontrolled memory allocation based on external input, which is a classic precursor to denial-of-service attacks. Furthermore, the behavior can be mapped to MITRE ATT&CK technique T1496: Resource Hijacking, where an adversary uses resources in ways that degrade system performance or availability. The specific mechanism of bypassing validation through character encoding anomalies also reflects aspects of CWE-20: Improper Input Validation, as the application fails to correctly interpret and sanitize input data before processing it for storage or transmission.
To mitigate this vulnerability, organizations must ensure that all instances of OpenTelemetry-Go are upgraded to version 1.33.0 or later, where the logic error in safeTruncateValidUTF8 has been corrected to properly handle valid Unicode replacement characters during truncation processes. For environments where immediate patching is not feasible, defensive measures should include implementing strict input validation at the application layer before data reaches the telemetry SDK. This includes enforcing maximum string lengths and filtering out or replacing suspicious character sequences prior to span creation. Additionally, monitoring memory usage metrics for instrumented services can help detect anomalous spikes that may indicate exploitation attempts, allowing for rapid incident response and isolation of affected components until a permanent fix is deployed.