Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnorm, sdk/log/internal/attrnorm, and trace/auto.go do not count valid U+FFFD replacement characters. This is a distinct incomplete-fix defect in the replacement truncation code introduced by the remediation for CVE-2026-81869. Values composed of or dominated by those characters can therefore exceed the configured character and memory bound in span, log-record, and auto-instrumentation trace attributes. Attacker-controlled telemetry attributes can increase retained memory and pipeline pressure, while confidentiality and integrity are not affected. This issue is fixed in version 1.47.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| open-telemetry | opentelemetry-go | >= 0.9.0, < 1.47.0 | — |
| open-telemetry | go.opentelemetry.io/otel/sdk | >= 1.33.0, < 1.47.0, >= 0.9.0, < 1.47.0, >= 1.35.0, < 1.47.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | go.opentelemetry.io/otel/sdk | >= 1.33.0, < 1.47.0 | 1.47.0 | GHSA-q7gw-24fr-5p69 |
| Go | go.opentelemetry.io/otel/sdk/log | >= 0.9.0, < 1.47.0 | 1.47.0 | GHSA-q7gw-24fr-5p69 |
| Go | go.opentelemetry.io/otel/trace | >= 1.35.0, < 1.47.0 | 1.47.0 | GHSA-q7gw-24fr-5p69 |
References
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-q7gw-24fr-5p69
- https://github.com/open-telemetry/opentelemetry-go/commit/017b08c7f1018b619991aaf6b2299d4beb9da1d3
- https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v1.47.0
- https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.47.0
- https://github.com/open-telemetry/opentelemetry-go/releases/tag/trace/v1.47.0