Summary
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
The OpenTelemetry Go SDK trace package can fail to enforce AttributeValueLengthLimit for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured memory/DoS protection and allowing increased per-span memory usage. The finding is low severity because it requires a deployment with attribute value length limits enabled and attacker-controlled data being recorded into span attributes.
Introduced in commit 49a6536
Details
String and string-slice span attributes are truncated through safeTruncate when AttributeValueLengthLimit is non-negative. The finding evidence identifies this enforcement path in sdk/trace/span.go:303-331, with string attributes passed to safeTruncate at sdk/trace/span.go:309-310 and string-slice entries passed to safeTruncate in the loop beginning at sdk/trace/span.go:312.
safeTruncate first calls safeTruncateValidUTF8; if that returns ok=false, it calls strings.ToValidUTF8(input, "") and retries. The relevant code is identified in sdk/trace/span.go:337-355. safeTruncateValidUTF8 treats any utf8.RuneError from utf8.DecodeRuneInString as invalid UTF-8 and immediately returns the original input with ok=false. However, Go also returns utf8.RuneError for a valid encoded U+FFFD rune. The validation artifact confirms this behavior with output r=U+FFFD size=3 runeError=true.
For an input such as "AAAA" + U+FFFD + strings.Repeat("B", 20) and a limit of 5, the first truncation attempt sees U+FFFD as utf8.RuneError and returns the full input with ok=false. strings.ToValidUTF8 does not remove the valid U+FFFD rune, so the second attempt returns the same full input. As a result, the span attribute value remains 27 bytes long even though the configured limit is 5.
PoC
The validation artifact contains a package-level Go test at validation-artifact.tar:safe_truncate_bypass/safe_truncate_poc_test.go and supporting output at validation-artifact.tar:safe_truncate_bypass/runecheck_output.txt.
Reproduction configuration:
- Repository:
pellared/opentelemetry-go - Commit:
49a6536from September 12, 2022 - Package/module path:
sdk/traceunder thesdkmodule - Attribute value length limit used by the PoC:
limit := 5 - Dependencies must be available through the network or a local module cache/vendor directory.
Commands:
cd /path/to/opentelemetry-go
git checkout 49a6536
tar -xOf /path/to/validation-artifact.tar safe_truncate_bypass/safe_truncate_poc_test.go > sdk/trace/safe_truncate_poc_test.go
cd sdk
go test ./trace -run TestSafeTruncateBypass -count=1 -v
Expected vulnerable output includes a failing test showing that the returned value exceeds the configured limit:
=== RUN TestSafeTruncateBypass
safe_truncate_poc_test.go:14: input_len=27 got_len=27 input="AAAA�BBBBBBBBBBBBBBBBBBBB" got="AAAA�BBBBBBBBBBBBBBBBBBBB"
safe_truncate_poc_test.go:16: bypass: got_len 27 > limit 5
--- FAIL: TestSafeTruncateBypass
The artifact also records the standalone UTF-8 behavior needed for the bypass:
tar -xOf /path/to/validation-artifact.tar safe_truncate_bypass/runecheck_output.txt
Expected output:
r=U+FFFD size=3 runeError=true
Impact
This is a Unicode handling and resource-limit bypass that weakens span attribute memory controls. Applications that enable AttributeValueLengthLimit to bound memory usage can still store oversized attacker-controlled attribute values if those values contain U+FFFD. The practical impact is increased memory use and reduced denial-of-service protection in the instrumented process; the finding does not show confidentiality or integrity impact.
Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-81869? CVE-2026-81869 is a medium-severity uncontrolled resource consumption vulnerability in go.opentelemetry.io/otel/sdk (go), affecting versions >= 1.10.0, < 1.33.0. It is fixed in 1.33.0. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
- Which versions of go.opentelemetry.io/otel/sdk are affected by CVE-2026-81869? go.opentelemetry.io/otel/sdk (go) versions >= 1.10.0, < 1.33.0 is affected.
- Is there a fix for CVE-2026-81869? Yes. CVE-2026-81869 is fixed in 1.33.0. Upgrade to this version or later.
- Is CVE-2026-81869 exploitable, and should I be worried? Whether CVE-2026-81869 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-81869 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-81869? Upgrade
go.opentelemetry.io/otel/sdkto 1.33.0 or later.