{"schema":"threatline.record/2","record":{"id":"CVE-2026-81869","aliases":["GHSA-p9f8-wvj8-2fg8","GO-2026-6616"],"summary":"OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation","details":"### Summary\n\nThe OpenTelemetry Go SDK trace package can fail to enforce `AttributeValueLengthLimit` for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured memory/DoS protection and allowing increased per-span memory usage. The finding is low severity because it requires a deployment with attribute value length limits enabled and attacker-controlled data being recorded into span attributes.\n\nIntroduced in commit 49a6536\n\n### Details\n\nString and string-slice span attributes are truncated through `safeTruncate` when `AttributeValueLengthLimit` is non-negative. The finding evidence identifies this enforcement path in `sdk/trace/span.go:303-331`, with string attributes passed to `safeTruncate` at `sdk/trace/span.go:309-310` and string-slice entries passed to `safeTruncate` in the loop beginning at `sdk/trace/span.go:312`.\n\n`safeTruncate` first calls `safeTruncateValidUTF8`; if that returns `ok=false`, it calls `strings.ToValidUTF8(input, \"\")` and retries. The relevant code is identified in `sdk/trace/span.go:337-355`. `safeTruncateValidUTF8` treats any `utf8.RuneError` from `utf8.DecodeRuneInString` as invalid UTF-8 and immediately returns the original input with `ok=false`. However, Go also returns `utf8.RuneError` for a valid encoded U+FFFD rune. The validation artifact confirms this behavior with output `r=U+FFFD size=3 runeError=true`.\n\nFor an input such as `\"AAAA\" + U+FFFD + strings.Repeat(\"B\", 20)` and a limit of 5, the first truncation attempt sees U+FFFD as `utf8.RuneError` and returns the full input with `ok=false`. `strings.ToValidUTF8` does not remove the valid U+FFFD rune, so the second attempt returns the same full input. As a result, the span attribute value remains 27 bytes long even though the configured limit is 5.\n\n### PoC\n\n[validation-artifact.zip](https://github.com/user-attachments/files/27494267/validation-artifact.zip)\n\n\nThe validation artifact contains a package-level Go test at `validation-artifact.tar:safe_truncate_bypass/safe_truncate_poc_test.go` and supporting output at `validation-artifact.tar:safe_truncate_bypass/runecheck_output.txt`.\n\nReproduction configuration:\n- Repository: `pellared/opentelemetry-go`\n- Commit: `49a6536` from September 12, 2022\n- Package/module path: `sdk/trace` under the `sdk` module\n- Attribute value length limit used by the PoC: `limit := 5`\n- Dependencies must be available through the network or a local module cache/vendor directory.\n\nCommands:\n```sh\ncd /path/to/opentelemetry-go\ngit checkout 49a6536\ntar -xOf /path/to/validation-artifact.tar safe_truncate_bypass/safe_truncate_poc_test.go > sdk/trace/safe_truncate_poc_test.go\ncd sdk\ngo test ./trace -run TestSafeTruncateBypass -count=1 -v\n```\n\nExpected vulnerable output includes a failing test showing that the returned value exceeds the configured limit:\n```text\n=== RUN   TestSafeTruncateBypass\n    safe_truncate_poc_test.go:14: input_len=27 got_len=27 input=\"AAAA�BBBBBBBBBBBBBBBBBBBB\" got=\"AAAA�BBBBBBBBBBBBBBBBBBBB\"\n    safe_truncate_poc_test.go:16: bypass: got_len 27 > limit 5\n--- FAIL: TestSafeTruncateBypass\n```\n\nThe artifact also records the standalone UTF-8 behavior needed for the bypass:\n```sh\ntar -xOf /path/to/validation-artifact.tar safe_truncate_bypass/runecheck_output.txt\n```\n\nExpected output:\n```text\nr=U+FFFD size=3 runeError=true\n```\n\n### Impact\n\nThis is a Unicode handling and resource-limit bypass that weakens span attribute memory controls. Applications that enable `AttributeValueLengthLimit` to bound memory usage can still store oversized attacker-controlled attribute values if those values contain U+FFFD. The practical impact is increased memory use and reduced denial-of-service protection in the instrumented process; the finding does not show confidentiality or integrity impact.","categories":["Libraries & packages"],"product":"go.opentelemetry.io/otel/sdk","vendor":"open-telemetry","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-p9f8-wvj8-2fg8","source_modified_at":"2026-09-29T17:59:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"go.opentelemetry.io/otel/sdk"},"range":">= 1.10.0, < 1.33.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-81869","source_modified_at":"2026-09-17T14:15:51.501Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"opentelemetry-go","vendor":"open-telemetry","versions":[{"version":">= 1.10.0, < 1.33.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-p9f8-wvj8-2fg8","source_modified_at":"2026-10-01T20:56:23.877100823Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"go.opentelemetry.io/otel/sdk","purl":"pkg:golang/go.opentelemetry.io/otel/sdk"},"ranges":[{"events":[{"introduced":"1.10.0"},{"fixed":"1.33.0"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-p9f8-wvj8-2fg8","source_modified_at":"2026-09-29T17:59:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"go.opentelemetry.io/otel/sdk"},"version":"1.33.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-p9f8-wvj8-2fg8","source_modified_at":"2026-10-01T20:56:23.877100823Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"go.opentelemetry.io/otel/sdk","purl":"pkg:golang/go.opentelemetry.io/otel/sdk"},"version":"1.33.0"}],"cvss":5.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0018,"percentile":0.07187,"score_date":"2026-10-23"},"published_at":"2026-09-16T20:41:15.806Z","modified_at":"2026-10-01T20:56:23.877100823Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-p9f8-wvj8-2fg8","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-29T17:59:11Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-81869","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-17T14:15:51.501Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-p9f8-wvj8-2fg8","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-01T20:56:23.877100823Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81869","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81869","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/open-telemetry/opentelemetry-go/issues/5996","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/open-telemetry/opentelemetry-go/pull/5997","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.33.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-p9f8-wvj8-2fg8","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-17T14:15:41.862542Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-01T20:56:23.877100823Z","content_hash":"ffd948e6e49116a12475e1fcfeab7b3237585728c6fff3001593726cb24f7b93"}}