CVE-2026-128085

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnorm, sdk/log/internal/attrnorm, and...

CVE-2026-128085

The OpenTelemetry-Go library contains a defect where the AttributeValueLengthLimit is bypassed by attribute values composed of valid U+FFFD (REPLACEMENT CHARACTER) runes. In versions 1.33.0 (SDK), 0.9.0 (SDK log), and 1.35.0 (trace) through 1.47.0 , the optimistic truncation path fails to count t...

CVE-2026-128085 opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnorm, sdk/log/internal/attrnorm, and...