Is CVE-2026-81869 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81869 being exploited in the wild.

How severe is CVE-2026-81869?

Medium severity, with a CVSS score of 4, published 16 September 2026.

Which products and versions are affected?

go.opentelemetry.io/otel/sdk (Go) >= 1.10.0, < 1.33.0, SEMVER:introduced=1.10.0,fixed=1.33.0; Opentelemetry-Go 1.10.0 to 1.33.0.

Is there a fix for CVE-2026-81869?

Yes. go.opentelemetry.io/otel/sdk (Go): upgrade to 1.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81869 attacked?

It is attacked over the network.

Am I affected by CVE-2026-81869?

Check whether you run go.opentelemetry.io/otel/sdk (Go) or Opentelemetry-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81869: OpenTelemetry-Go attribute truncation bypass with Unicode replacement character

Q: Is there a fix for CVE-2026-81869?

Yes. go.opentelemetry.io/otel/sdk (Go): upgrade to 1.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-81869 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-81869?

Check whether you run go.opentelemetry.io/otel/sdk (Go) or Opentelemetry-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81869 · Severity: medium · CVSS 4 · Published 2026-09-16

OpenTelemetry-Go is a tracing library used to instrument applications and collect performance metrics. A flaw in its attribute value truncation logic allows attackers to bypass length limits on span attributes containing certain Unicode characters, potentially causing excessive memory use and weakening denial-of-service protections in monitored applications.

Technologies: go.opentelemetry.io/otel/sdk (Go), Opentelemetry-Go. Vendors: Go, Opentelemetry.

Quick answers

Is CVE-2026-81869 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81869 being exploited in the wild.
How severe is CVE-2026-81869?: Medium severity, with a CVSS score of 4, published 16 September 2026.
Which products and versions are affected?: go.opentelemetry.io/otel/sdk (Go) >= 1.10.0, < 1.33.0, SEMVER:introduced=1.10.0,fixed=1.33.0; Opentelemetry-Go 1.10.0 to 1.33.0.
Is there a fix for CVE-2026-81869?: Yes. go.opentelemetry.io/otel/sdk (Go): upgrade to 1.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81869 attacked?: It is attacked over the network.
Am I affected by CVE-2026-81869?: Check whether you run go.opentelemetry.io/otel/sdk (Go) or Opentelemetry-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.opentelemetry.io/otel/sdk (Go): upgrade to 1.33.0 or later
```
go get go.opentelemetry.io/otel/sdk@v1.33.0
```

Technical details

The vulnerability is in the sdk/trace/span.go attribute truncation logic between versions 1.10.0 and 1.33.0. The safeTruncateValidUTF8 function incorrectly treats the valid Unicode replacement character U+FFFD as invalid UTF-8 and returns the original (untruncated) input. Subsequent truncation attempts via strings.ToValidUTF8 leave this valid rune unchanged, allowing attribute values to exceed the configured AttributeValueLengthLimit. An attacker controlling span attribute content can inject oversized values with this character to bypass length enforcement. The fix was applied in version 1.33.0 and corrects the truncation to count characters (not bytes) per the OpenTelemetry specification.

Affected products

OpenTelemetry OpenTelemetry-Go 1.10.0 to 1.33.0

Identifiers

CVE-2026-81869
GHSA-p9f8-wvj8-2fg8
GO-2026-6616

Timeline

2026-09-16: disclosed
2024-11-26: patched: Fixed in version 1.33.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.