{"id":"CVE-2026-128085","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-128085","summary":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit…","details":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnorm, sdk/log/internal/attrnorm, and trace/auto.go do not count valid U+FFFD replacement characters. This is a distinct incomplete-fix defect in the replacement truncation code introduced by the remediation for CVE-2026-81869. Values composed of or dominated by those characters can therefore exceed the configured character and memory bound in span, log-record, and auto-instrumentation trace attributes. Attacker-controlled telemetry attributes can increase retained memory and pipeline pressure, while confidentiality and integrity are not affected. This issue is fixed in version 1.47.0.","published":"2026-11-13T18:53:14.393Z","modified":"2026-11-13T18:53:14.393Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/open-telemetry/opentelemetry-go/commit/017b08c7f1018b619991aaf6b2299d4beb9da1d3","label":"open-telemetry/opentelemetry-go@017b08c"},"references":[{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-q7gw-24fr-5p69"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-go/commit/017b08c7f1018b619991aaf6b2299d4beb9da1d3"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v1.47.0"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.47.0"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/trace/v1.47.0"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-13T18:53:14.393Z"}}