{"id":"EUVD-2026-81260","enisaUuid":"8cf6d756-eddb-366e-afaf-ccd67910215a","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","datePublished":"Sep 16, 2026, 8:41:15 PM","dateUpdated":"Sep 17, 2026, 2:15:51 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8\nhttps://github.com/open-telemetry/opentelemetry-go/issues/5996\nhttps://github.com/open-telemetry/opentelemetry-go/pull/5997\nhttps://github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a\nhttps://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.33.0\n","aliases":"CVE-2026-81869\nGHSA-p9f8-wvj8-2fg8\n","assigner":"GitHub_M","epss":0.18,"enisaIdProduct":[{"id":"307c119c-21d0-3744-a857-12dc8d3b1874","product":{"name":"opentelemetry-go","vendor":{"name":"open-telemetry"}},"product_version":"1.10.0, \u003c 1.33.0"}],"enisaIdVendor":[{"id":"f05436c0-17d0-38b4-bfbc-036e6f5d99f8","vendor":{"name":"open-telemetry"}}],"enisaIdVulnerability":[{"id":"8aac6c5f-1c00-3654-9182-63cf358ffd75","vulnerability":{"id":"GHSA-p9f8-wvj8-2fg8","description":"OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation","datePublished":"Sep 29, 2026, 5:59:10 PM","dateUpdated":"Sep 29, 2026, 5:59:10 PM","baseScore":0.0,"references":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-81869\nhttps://github.com/open-telemetry/opentelemetry-go/issues/5996\nhttps://github.com/open-telemetry/opentelemetry-go/pull/5997\nhttps://github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a\nhttps://github.com/open-telemetry/opentelemetry-go\nhttps://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.33.0\n","enisa_id":"EUVD-2026-81260\n","aliases":"CVE-2026-81869\nGHSA-p9f8-wvj8-2fg8\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:06:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9613482e-d110-3561-abd9-82cf169c550b","vulnerability":{"id":"CVE-2026-81869","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","datePublished":"Sep 16, 2026, 8:41:15 PM","dateUpdated":"Sep 17, 2026, 2:15:51 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8\nhttps://github.com/open-telemetry/opentelemetry-go/issues/5996\nhttps://github.com/open-telemetry/opentelemetry-go/pull/5997\nhttps://github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a\nhttps://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.33.0\n","enisa_id":"EUVD-2026-81260\n","assigner":"GitHub_M","epss":0.18,"dataProcessed":"Nov 3, 2026, 7:20:42 AM","vulnerabilityProduct":[{"id":"c13acff5-cc27-3441-98a4-f914496c1e5e","product":{"name":"opentelemetry-go","vendor":{"name":"open-telemetry"}},"product_version":"1.10.0, \u003c 1.33.0"}],"vulnerabilityVendor":[{"id":"9dd8264b-7c13-35ce-a940-18c86b74db18","vendor":{"name":"open-telemetry"}}]}}],"enisaIdAdvisory":[]}