# CVE-2026-81869: OpenTelemetry-Go attribute truncation bypass with Unicode replacement character

Source: https://junglewise.ai/threats/cve-2026-81869-opentelemetry-go-attribute-truncation-bypass-with-unicode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-81869 · Severity: medium · CVSS 4 · Published 2026-09-16

OpenTelemetry-Go is a tracing library used to instrument applications and collect performance metrics. A flaw in its attribute value truncation logic allows attackers to bypass length limits on span attributes containing certain Unicode characters, potentially causing excessive memory use and weakening denial-of-service protections in monitored applications.

Technologies: [go.opentelemetry.io/otel/sdk (Go)](https://junglewise.ai/threats/technologies/go-opentelemetry-io-otel-sdk), [Opentelemetry-Go](https://junglewise.ai/threats/technologies/opentelemetry-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry).

## Quick answers

**Is CVE-2026-81869 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81869 being exploited in the wild.

**How severe is CVE-2026-81869?** Medium severity, with a CVSS score of 4, published 16 September 2026.

**Which products and versions are affected?** go.opentelemetry.io/otel/sdk (Go) >= 1.10.0, < 1.33.0, SEMVER:introduced=1.10.0,fixed=1.33.0; Opentelemetry-Go 1.10.0 to 1.33.0.

**Is there a fix for CVE-2026-81869?** Yes. go.opentelemetry.io/otel/sdk (Go): upgrade to 1.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81869 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-81869?** Check whether you run go.opentelemetry.io/otel/sdk (Go) or Opentelemetry-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- go.opentelemetry.io/otel/sdk (Go): upgrade to 1.33.0 or later

  ```sh
  go get go.opentelemetry.io/otel/sdk@v1.33.0
  ```


## Technical details

The vulnerability is in the sdk/trace/span.go attribute truncation logic between versions 1.10.0 and 1.33.0. The safeTruncateValidUTF8 function incorrectly treats the valid Unicode replacement character U+FFFD as invalid UTF-8 and returns the original (untruncated) input. Subsequent truncation attempts via strings.ToValidUTF8 leave this valid rune unchanged, allowing attribute values to exceed the configured AttributeValueLengthLimit. An attacker controlling span attribute content can inject oversized values with this character to bypass length enforcement. The fix was applied in version 1.33.0 and corrects the truncation to count characters (not bytes) per the OpenTelemetry specification.

## Affected products

- OpenTelemetry OpenTelemetry-Go 1.10.0 to 1.33.0

## Identifiers

- CVE-2026-81869
- GHSA-p9f8-wvj8-2fg8
- GO-2026-6616

## Timeline

- 2026-09-16: disclosed
- 2024-11-26: patched: Fixed in version 1.33.0

## References

- [https://github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a](https://github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a)
- [https://github.com/open-telemetry/opentelemetry-go/issues/5996](https://github.com/open-telemetry/opentelemetry-go/issues/5996)

## Related threats

- [OpenTelemetry-Go BatchingProcessor CPU exhaustion via log emission](https://junglewise.ai/threats/cve-2026-81872-opentelemetry-go-batchingprocessor-cpu-exhaustion-via-log)
- [OpenTelemetry-Go OTLP log gRPC exporter TLS certificate validation bypass](https://junglewise.ai/threats/cve-2026-81871-opentelemetry-go-otlp-log-grpc-exporter-tls-certificate)
- [OpenTelemetry-Go endpoint URL logging in TracerProvider diagnostics](https://junglewise.ai/threats/cve-2026-81870-opentelemetry-go-endpoint-url-logging-in-tracerprovider)
- [OpenTelemetry-Go unsynchronized baggage map race condition](https://junglewise.ai/threats/cve-2026-45404-opentelemetry-go-unsynchronized-baggage-map-race-condition)
- [OpenTelemetry OpenTelemetry-Go untrusted search path in host ID detection](https://junglewise.ai/threats/cve-2026-39883-opentelemetry-opentelemetry-go-untrusted-search-path-in-host-id)