{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "1.10.0"
              },
              {
                "fixed": "1.33.0"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0e6f9c29c10d6078e8131418e1d1d166c7195d61"
            },
            {
              "fixed": "e016a78c9f5b24a1c2beeaad47686c2f2213f49a"
            }
          ],
          "repo": "https://github.com/open-telemetry/opentelemetry-go",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-p9f8-wvj8-2fg8"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-176",
      "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81869.json"
  },
  "details": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.",
  "id": "CVE-2026-81869",
  "modified": "2026-09-19T03:30:34.898023369Z",
  "published": "2026-09-16T20:41:15.806Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.33.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81869.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81869"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/open-telemetry/opentelemetry-go/issues/5996"
    },
    {
      "type": "FIX",
      "url": "https://github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a"
    },
    {
      "type": "FIX",
      "url": "https://github.com/open-telemetry/opentelemetry-go/pull/5997"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation"
}