{"id":"CVE-2026-81869","title":"OpenTelemetry-Go is the Go implementation of OpenTelemetry","summary":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing…","severity":"medium","cvss":5.1,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","cwe":["CWE-176","CWE-400"],"vendor":"open-telemetry","product":"opentelemetry-go","affected":["opentelemetry-go >= 1.10.0, < 1.33.0"],"published":"2026-09-16","updated":"2026-09-17","sourceUpdated":"2026-09-17T15:16:52.823","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81869","references":[{"url":"https://github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a","label":"security-advisories@github.com"},{"url":"https://github.com/open-telemetry/opentelemetry-go/issues/5996","label":"security-advisories@github.com"},{"url":"https://github.com/open-telemetry/opentelemetry-go/pull/5997","label":"security-advisories@github.com"},{"url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.33.0","label":"security-advisories@github.com"},{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8","label":"security-advisories@github.com"},{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81869.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-81869"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81869"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81869"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T14:15:41.862542Z"},"cvssSource":"cna","ingestedAt":"2026-09-16T21:05:36.880Z","scores":{"cna":5.1,"vendor":4},"epss":0.00126,"epssPercentile":0.02666,"slug":"CVE-2026-81869","body":"## Overview\n\nOpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81869.json)","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":28.1,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":206154,"id":"CVE-2026-81869","ts":1789658479167,"field":"exploit_available","old":"false","new":"true"}]}