CVE-2026-128085

MEDIUM

MEDIUM Priority: 0.00 BB Relevance: 71/100

Published: 2026-11-13 Modified: 2026-11-13 First seen: 2026-11-13 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: None

S: Unchanged

C: None

I: None

A: Low

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnorm, sdk/log/internal/attrnorm, and trace/auto.go do not count valid U+FFFD replacement characters. This is a distinct incomplete-fix defect in the replacement truncation code introduced by the remediation for CVE-2026-81869. Values composed of or dominated by those characters can therefore exceed the configured character and memory bound in span, log-record, and auto-instrumentation trace attributes. Attacker-controlled telemetry attributes can increase retained memory and pipeline pressure, while confidentiality and integrity are not affected. This issue is fixed in version 1.47.0.

Weakness Classification (2)

CWE-135 — CWE-135: Incorrect Calculation of Multi-Byte String Length CWE-770 — CWE-770: Allocation of Resources Without Limits or Throttling

Affected Software (4)

Vendor	Product	Version
open-telemetry	go.opentelemetry.io/otel/sdk	>= 1.33.0, < 1.47.0
open-telemetry	go.opentelemetry.io/otel/sdk	>= 0.9.0, < 1.47.0
open-telemetry	go.opentelemetry.io/otel/sdk	>= 1.35.0, < 1.47.0
open-telemetry	opentelemetry-go	>= 0.9.0, < 1.47.0