OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation

Summary The OpenTelemetry Go SDK trace package can fail to enforce AttributeValueLengthLimit for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured...

EUVD-2026-81260

OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation...

AZL-103245 CVE-2026-81869 affecting package moby-engine 25.0.3-20

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...

AZL-103143 CVE-2026-81869 affecting package cert-manager for versions less than 1.12.15-14

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...

AZL-103170 CVE-2026-81869 affecting package flannel 0.24.2-32

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...

AZL-103233 CVE-2026-81869 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...

UBUNTU-CVE-2026-81869

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...

CVE-2026-81869

OpenTelemetry-Go versions 1.10.0 through 1.33.0 contain a flaw in the sdk/trace/span.go attribute truncation path. When a string or string-slice attribute contains the valid Unicode replacement character U+FFFD , the safeTruncateValidUTF8 function misidentifies it as invalid UTF-8 and returns the...

CVE-2026-81869: Improper Handling of Unicode Encoding

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...