Executive brief
OpenTelemetry-Go is a tracing library used to instrument applications and collect performance metrics. A flaw in its attribute value truncation logic allows attackers to bypass length limits on span attributes containing certain Unicode characters, potentially causing excessive memory use and weakening denial-of-service protections in monitored applications.
Technical details
The vulnerability is in the sdk/trace/span.go attribute truncation logic between versions 1.10.0 and 1.33.0. The safeTruncateValidUTF8 function incorrectly treats the valid Unicode replacement character U+FFFD as invalid UTF-8 and returns the original (untruncated) input. Subsequent truncation attempts via strings.ToValidUTF8 leave this valid rune unchanged, allowing attribute values to exceed the configured AttributeValueLengthLimit. An attacker controlling span attribute content can inject oversized values with this character to bypass length enforcement. The fix was applied in version 1.33.0 and corrects the truncation to count characters (not bytes) per the OpenTelemetry specification.
Affected products
- OpenTelemetry OpenTelemetry-Go 1.10.0 to 1.33.0
Timeline
- 2026-09-16: disclosed
- 2024-11-26: patched: Fixed in version 1.33.0