TI-2026-56483 Aliases CVE-2026-81869 GHSA-p9f8-wvj8-2fg8

OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation

MEDIUM 56CWE-176Published 2026-09-16 · Updated 2026-09-17

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0018 7th percentileScored 2026-11-07

Fix Fixed opentelemetry-go (open-telemetry): 1.33.0go.opentelemetry.io/otel/sdk (Go): 1.33.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
open-telemetry	opentelemetry-go	1.10.0 to before 1.33.0	1.33.0	Patch available	CNA
—	go.opentelemetry.io/otel/sdk (Go)	1.10.0 to before 1.33.0	1.33.0	Patch available	GHSA-p9f8-wvj8-2fg8

opentelemetry-go Vendoropen-telemetry Affected 1.10.0 to before 1.33.0 Fixed in 1.33.0 Patch available CNA
go.opentelemetry.io/otel/sdk (Go) Vendor— Affected 1.10.0 to before 1.33.0 Fixed in 1.33.0 Patch available GHSA-p9f8-wvj8-2fg8

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:opentelemetry:opentelemetry::::::::	—	—	open-telemetry

cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:*:*:* Versions — — ·open-telemetry

Remediation

Fix · CNA opentelemetry-go (open-telemetry) Fixed in 1.33.0
Fix · GHSA-p9f8-wvj8-2fg8 go.opentelemetry.io/otel/sdk (Go) Fixed in 1.33.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-81869
2026-10-03 Alias added: GHSA-p9f8-wvj8-2fg8

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-81869

Other 6

TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5

See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences