OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
### Summary The OpenTelemetry Go SDK trace package can fail to enforce `AttributeValueLengthLimit` for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured memory/DoS protection and allowing increased per-span memory usage. The finding is low severity because it requires a deployment with attribute value length limits enabled and attacker-controlled data being recorded into span attributes. Introduced in commit 49a6536 ### Details String and string-slice span attributes are truncated through `safeTruncate` when `AttributeValueLengthLimit` is non-negative. The finding evidence identifies this enforcement path in `sdk/trace/span.go:303-331`, with string attributes passed to `safeTruncate` at `sdk/trace/span.go:309-310` and string-slice entries passed to `safeTruncate` in the loop beginning at `sdk/trace/span.go:312`. `safeTruncate` first calls `safeTruncateValidUTF8`; if that returns `ok=false`, it calls `strings.ToValidUTF8(input, "")` and retries. The relevant code is identified in `sdk/trace/span.go:337-355`. `safeTruncateValidUTF8` treats any `utf8.RuneError` from `utf8.DecodeRuneInString` as invalid UTF-8 and immediately returns the original input with `ok=false`. However, Go also returns `utf8.RuneError` for a valid encoded U+FFFD rune. The validation artifact confirms this behavior with output `r=U+FFFD size=3 runeError=true`. Fo
GO-2026-6616
Revision 1
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation in go.opentelemetry.io/otel/sdk
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation in go.opentelemetry.io/otel/sdk
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GO-2026-6616
go.opentelemetry.io/otel/sdk
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.33.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "1.10.0"
},
{
"fixed": "1.33.0"
}
]
}
],
"package": {
"name": "go.opentelemetry.io/otel/sdk",
"purl": "pkg:golang/go.opentelemetry.io/otel/sdk",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://vuln.go.dev/ID/GO-2026-6616.json"
},
"ecosystem_specific": {}
}
]- Related CVEs
- CVE-2026-81869
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #63869 · Revision 1
- Added to Heist Feed
- Publisher date
GHSA-p9f8-wvj8-2fg8
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-p9f8-wvj8-2fg8
go.opentelemetry.io/otel/sdk
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.33.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "1.10.0"
},
{
"fixed": "1.33.0"
}
]
}
],
"package": {
"name": "go.opentelemetry.io/otel/sdk",
"purl": "pkg:golang/go.opentelemetry.io/otel/sdk",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-p9f8-wvj8-2fg8/GHSA-p9f8-wvj8-2fg8.json"
}
}
]- Related CVEs
- CVE-2026-81869
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #63990 · Revision 1
- Added to Heist Feed
- Publisher date