{"affected":[{"product":"opentelemetry-go","source":"CNA: GitHub_M","vendor":"open-telemetry","versions":[{"status":"affected","version":">= 0.9.0, < 1.47.0"}]},{"product":"go.opentelemetry.io/otel/sdk","source":"CNA: GitHub_M","vendor":"open-telemetry","versions":[{"status":"affected","version":">= 1.33.0, < 1.47.0"}]},{"product":"go.opentelemetry.io/otel/sdk","source":"CNA: GitHub_M","vendor":"open-telemetry","versions":[{"status":"affected","version":">= 0.9.0, < 1.47.0"}]},{"product":"go.opentelemetry.io/otel/sdk","source":"CNA: GitHub_M","vendor":"open-telemetry","versions":[{"status":"affected","version":">= 1.35.0, < 1.47.0"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"go.opentelemetry.io/otel/sdk","product":"go.opentelemetry.io/otel/sdk","source":"OSV GHSA-q7gw-24fr-5p69","vendor":"","versions":[{"events":[{"introduced":"1.33.0"},{"fixed":"1.47.0"}],"lessThan":"1.47.0","status":"affected","version":"1.33.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"go.opentelemetry.io/otel/sdk/log","product":"go.opentelemetry.io/otel/sdk/log","source":"OSV GHSA-q7gw-24fr-5p69","vendor":"","versions":[{"events":[{"introduced":"0.9.0"},{"fixed":"1.47.0"}],"lessThan":"1.47.0","status":"affected","version":"0.9.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"go.opentelemetry.io/otel/trace","product":"go.opentelemetry.io/otel/trace","source":"OSV GHSA-q7gw-24fr-5p69","vendor":"","versions":[{"events":[{"introduced":"1.35.0"},{"fixed":"1.47.0"}],"lessThan":"1.47.0","status":"affected","version":"1.35.0","versionType":"semver"}]}],"cveId":"CVE-2026-128085","cwes":["CWE-135","CWE-770"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnorm, sdk/log/internal/attrnorm, and trace/auto.go do not count valid U+FFFD replacement characters. This is a distinct incomplete-fix defect in the replacement truncation code introduced by the remediation for CVE-2026-81869. Values composed of or dominated by those characters can therefore exceed the configured character and memory bound in span, log-record, and auto-instrumentation trace attributes. Attacker-controlled telemetry attributes can increase retained memory and pipeline pressure, while confidentiality and integrity are not affected. This issue is fixed in version 1.47.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1794597305908,"publishedAt":1794595994393,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-q7gw-24fr-5p69"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-go/commit/017b08c7f1018b619991aaf6b2299d4beb9da1d3"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v1.47.0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.47.0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/trace/v1.47.0"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-q7gw-24fr-5p69"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-q7gw-24fr-5p69"}],"remediation":[{"kind":"fix","source":"OSV GHSA-q7gw-24fr-5p69","text":"go.opentelemetry.io/otel/sdk (Go): OSV reports a fixed version 1.47.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-q7gw-24fr-5p69"},{"kind":"fix","source":"OSV GHSA-q7gw-24fr-5p69","text":"go.opentelemetry.io/otel/sdk/log (Go): OSV reports a fixed version 1.47.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-q7gw-24fr-5p69"},{"kind":"fix","source":"OSV GHSA-q7gw-24fr-5p69","text":"go.opentelemetry.io/otel/trace (Go): OSV reports a fixed version 1.47.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-q7gw-24fr-5p69"}],"revision":"416fe54935f53d5f0d0b3bfefe7277e832802d72b0684d2b63ea09de67091942","sources":[{"modifiedAt":1794595994393,"name":"CNA: GitHub_M","retrievedAt":1794597923403,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128085"},{"modifiedAt":1794597305908,"name":"OSV / GitHub Security Advisories","retrievedAt":1794597924168,"url":"https://osv.dev/vulnerability/GHSA-q7gw-24fr-5p69"}],"ssvc":null,"status":"published","title":"opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes","updatedAt":1794597924168}