OpenTelemetry Go SDK EUVD-2026-81260

Requires that (1) the instrumented Go application uses opentelemetry-go SDK trace between 1.10.0 and 1.33.0, (2) an AttributeValueLengthLimit is actually configured (the limit being bypassed), and (3) the attacker can influence content that the application records as a string or string-slice span attribute, specifically embedding the valid Unicode replacement character U+FFFD so the truncation path returns the original oversized value. Limiting factors: impact is confined to increased memory within the instrumented process (no code execution, data disclosure, or crash guarantee); meaningful denial-of-service requires sustained high-volume malicious input; and deployments not enforcing a length limit see no behavioral change. The vendor rates the vector as local (AV:L), which further constrains scoring, though real attribute content is frequently derived from remote input.

This is a low-to-moderate real-world risk, best characterized as a defense-in-depth/hardening weakness rather than a directly exploitable flaw. The vendor CVSS 4.0 vector (5.1, AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) correctly caps impact at low availability only - there is no confidentiality or integrity impact, and the sole effect is that oversized attribute values evade the configured AttributeValueLengthLimit, increasing per-span memory use. There is no EPSS score, no CISA KEV listing, and no public exploit code (only the fix PR, issue, and advisory), so exploitation status is 'no public exploit identified at time of analysis.' The most notable data tension is the attack vector: the vendor scored AV:L, yet the description says an attacker merely needs to 'control span attribute content,' which in most instrumented services is populated from network-facing input (HTTP headers, request parameters, user-supplied fields) - verify AV with the vendor, as AV:N (my assessment, ~5.3) is arguably more representative of real deployments. Either way the ceiling is a marginal memory-pressure amplification that only matters where a length limit was deliberately relied upon for DoS mitigation, so this is a patch-in-normal-cycle issue, not an emergency.

An attacker who can influence data recorded as span attributes (e.g. a request field, header, or user-controlled string that the instrumented Go service traces) crafts values that exceed AttributeValueLengthLimit but embed the valid Unicode replacement character U+FFFD. Because the SDK's truncation path returns the original oversized value instead of trimming it, the process retains large attributes across many spans, gradually inflating memory use and weakening the DoS protection the limit was meant to provide. No public exploit code exists; this requires sustained high-volume malicious input to produce meaningful memory pressure.