CVE-2026-81869: OpenTelemetry-Go DOS Vulnerability

CVE-2026-81869 Overview

CVE-2026-81869 affects OpenTelemetry-Go, the Go implementation of the OpenTelemetry observability framework. The vulnerability exists in the span attribute truncation logic within sdk/trace/span.go from version 1.10.0 through 1.32.x. The safeTruncateValidUTF8 function incorrectly treats the valid Unicode replacement character U+FFFD as invalid UTF-8. This causes the truncation path to return the original oversized input, bypassing the configured AttributeValueLengthLimit. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory consumption in the instrumented process. The issue is fixed in version 1.33.0 [CWE-176].

Critical Impact
Attackers who influence span attribute content can bypass length limits, inflating memory usage and weakening denial-of-service protections in instrumented Go services.

Affected Products

OpenTelemetry-Go SDK versions 1.10.0 through 1.32.x
Go applications using go.opentelemetry.io/otel/sdk/trace for tracing
Services relying on AttributeValueLengthLimit for span attribute size enforcement

Discovery Timeline

2026-09-16 - CVE-2026-81869 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81869

Vulnerability Analysis

The vulnerability resides in the attribute truncation code path in sdk/trace/span.go. When a string or string-slice span attribute exceeds the configured AttributeValueLengthLimit, the SDK calls safeTruncate to shorten the value while preserving valid UTF-8. The safeTruncate helper delegates to safeTruncateValidUTF8, which incorrectly classifies the valid Unicode replacement rune U+FFFD as invalid UTF-8. When that classification fails, the function returns the original input unchanged. A follow-up call to strings.ToValidUTF8 leaves U+FFFD untouched because it is already valid, so a subsequent safeTruncate attempt reaches the same failure mode and again returns the oversized value. The result is that any attacker-controlled span attribute containing U+FFFD retains its full length regardless of the configured limit.

Root Cause

The root cause is improper handling of a valid Unicode code point [CWE-176]. safeTruncateValidUTF8 conflates the presence of U+FFFD with the presence of malformed UTF-8 sequences. Because Go's strings.ToValidUTF8 does not rewrite legitimate replacement characters, the sanitization loop cannot converge, and the truncation guarantee is silently dropped.

Attack Vector

An attacker who can influence span attribute content, such as HTTP headers, request bodies, or user-supplied identifiers propagated into traces, embeds U+FFFD characters within oversized strings. The instrumented process then stores the full-length attribute in memory and forwards it downstream, amplifying memory pressure across the tracing pipeline and reducing the effectiveness of denial-of-service safeguards.

 	}
 	switch attr.Value.Type() {
 	case attribute.STRING:
-		if v := attr.Value.AsString(); len(v) > limit {
-			return attr.Key.String(safeTruncate(v, limit))
-		}
+		v := attr.Value.AsString()
+		return attr.Key.String(truncate(limit, v))
 	case attribute.STRINGSLICE:
 		v := attr.Value.AsStringSlice()
 		for i := range v {
-			if len(v[i]) > limit {
-				v[i] = safeTruncate(v[i], limit)
-			}
+			v[i] = truncate(limit, v[i])
 		}
 		return attr.Key.StringSlice(v)
 	}
 	return attr
 }

-// safeTruncate truncates the string and guarantees valid UTF-8 is returned.
-func safeTruncate(input string, limit int) string {
-	if trunc, ok := safeTruncateValidUTF8(input, limit); ok {
-		return trunc
+// truncate returns a truncated version of s such that it contains less than
+// the limit number of characters. Truncation is applied by returning the limit
+// number of valid characters contained in s.
+//
+// If limit is negative, it returns the original string.

Source: GitHub Commit e016a78. The patch replaces the buggy safeTruncate with a rewritten truncate function that iterates over valid runes and enforces the character limit directly.

Detection Methods for CVE-2026-81869

Indicators of Compromise

Span attributes exported from an instrumented Go service with string lengths that exceed the configured AttributeValueLengthLimit.
Unusual concentrations of the U+FFFD replacement character within span attribute values originating from external input.
Growth in per-span payload size reported by OpenTelemetry Collectors or backends despite an enforced length limit.

Detection Strategies

Inspect exported spans in your tracing backend and alert when attribute string lengths exceed the SDK-configured limit.
Add pipeline processors in the OpenTelemetry Collector to measure attribute length distributions and flag outliers.
Perform a software composition analysis pass on Go modules to identify services still importing go.opentelemetry.io/otel/sdk below v1.33.0.

Monitoring Recommendations

Track process resident memory and heap allocations for services generating traces from untrusted input.
Emit metrics on dropped or truncated spans at the Collector and correlate spikes with upstream service behavior.
Log the effective AttributeValueLengthLimit at startup so operators can audit configuration drift.

How to Mitigate CVE-2026-81869

Immediate Actions Required

Upgrade go.opentelemetry.io/otel/sdk to version 1.33.0 or later and rebuild affected Go services.
Audit all services that ingest untrusted content into span attributes and prioritize them for patching.
Review the GitHub Security Advisory GHSA-p9f8-wvj8-2fg8 for authoritative remediation guidance.

Patch Information

The fix was released in OpenTelemetry-Go SDK v1.33.0 via Pull Request #5997. The patch removes safeTruncate and introduces a rune-aware truncate function that enforces the configured character limit regardless of whether the input contains U+FFFD. See Issue #5996 for the original report.

Workarounds

Sanitize or reject externally sourced strings containing U+FFFD before adding them as span attributes.
Truncate attribute values in application code prior to invoking OpenTelemetry APIs, using a rune-safe helper.
Apply length caps at the OpenTelemetry Collector using a transform or attributes processor to enforce limits downstream.

bash

# Upgrade the OpenTelemetry-Go SDK to the fixed release
go get go.opentelemetry.io/otel/sdk@v1.33.0
go mod tidy
go build ./...