CVE-2026-81869 OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
Attackers can bypass attribute length limits in OpenTelemetry-Go by using Unicode replacement characters, causing excessive memory consumption and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81869?
CVE-2026-81869 is a medium-severity denial of service vulnerability in open-telemetry opentelemetry-go, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.
Which versions are affected by CVE-2026-81869?
3 open source packages ship an affected version, including go.opentelemetry.io/otel/sdk.
| Package | Affected | Fixed in |
|---|---|---|
go.opentelemetry.io/otel/sdk Go | From 1.10.0 | 1.33.0 |
go.opentelemetry.io/otel/sdk Go | From 1.10.0 | 1.33.0 |
go.opentelemetry.io/otel/sdk Go | From 1.10.0 | 1.33.0 |
How do I fix CVE-2026-81869?
Upgrade go.opentelemetry.io/otel/sdk to 1.33.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-81869 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81869 exists.
Sources
Also known as AZL-103073, AZL-103131, AZL-103143, AZL-103149, AZL-103155, AZL-103161 and 125 more.