CVE-2026-81869: 
CBL Mariner 취약성 분석 및 완화

CVE-2026-81869 is a Unicode handling flaw in OpenTelemetry-Go (the Go implementation of OpenTelemetry) that allows an attacker who controls span attribute content to bypass the configured AttributeValueLengthLimit, causing increased per-span memory consumption and weakening denial-of-service protections. The vulnerability affects go.opentelemetry.io/otel/sdk/trace versions >= 1.10.0 and < 1.33.0. It was published on September 16, 2026, and fixed in version 1.33.0. It carries a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper handling of the Unicode replacement character U+FFFD (CWE-176: Improper Handling of Unicode Encoding; CWE-400: Uncontrolled Resource Consumption; CWE-135: Incorrect Calculation of Multi-Byte String Length). In sdk/trace/span.go, the safeTruncateValidUTF8 function uses utf8.DecodeRuneInString to validate characters; however, Go's utf8 package returns utf8.RuneError=true for the valid 3-byte U+FFFD sequence, causing the function to incorrectly treat it as invalid UTF-8 and return the original, untruncated input with ok=false. The fallback path then calls strings.ToValidUTF8(input, ""), which leaves the valid U+FFFD rune unchanged, so the second truncation attempt also fails to enforce the limit. An attacker must be able to inject span attribute values into the instrumented application and the deployment must have AttributeValueLengthLimit configured to a non-negative value (GitHub Advisory, Fix PR #5997).

Successful exploitation allows an attacker to store span attribute values in memory that far exceed the configured AttributeValueLengthLimit — for example, a 27-byte value persisting despite a limit of 5 bytes. The primary impact is increased per-span memory consumption in the instrumented process, which weakens the denial-of-service protection that the attribute length limit is designed to provide. There is no confidentiality or integrity impact; the vulnerability is limited to availability (resource exhaustion) of the affected process (GitHub Advisory).

A proof-of-concept Go test (safe_truncate_poc_test.go) is publicly available in the GitHub security advisory, demonstrating the bypass with specific reproduction commands and expected output (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.00126 (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is not automatable and requires the attacker to control or influence span attribute values passed to the traced application.

1. Identify a vulnerable deployment: Confirm the target application uses go.opentelemetry.io/otel/sdk/trace version >= 1.10.0 and < 1.33.0, and that AttributeValueLengthLimit is configured to a non-negative value in the SDK.
2. Craft a malicious span attribute value: Construct a string payload containing the Unicode replacement character U+FFFD (3-byte UTF-8 sequence: EF BF BD) followed by additional data, such that the total length exceeds the configured limit. Example: "AAAA" + "\uFFFD" + strings.Repeat("B", 20) (27 bytes total with a limit of 5).
3. Inject the payload into span attributes: Submit the crafted string as a span attribute via the application's tracing API, or via HTTP headers, query parameters, or other user-controlled inputs that the application records as span attributes.
4. Trigger the truncation bypass: The safeTruncateValidUTF8 function encounters U+FFFD, misidentifies it as invalid UTF-8 (utf8.RuneError=true), and returns the full input untruncated. The fallback strings.ToValidUTF8 call leaves U+FFFD unchanged, and the second truncation attempt also fails.
5. Observe the bypass: The span attribute is stored in memory at its full oversized length (e.g., 27 bytes despite a limit of 5), as confirmed by PoC output got_len 27 > limit 5. Repeated injection of such payloads increases per-span memory consumption, degrading the DoS protection of the instrumented process (GitHub Advisory).

• Application Behavior: Unexpectedly high memory consumption in Go processes instrumented with OpenTelemetry SDK versions 1.10.0–1.32.x, particularly when AttributeValueLengthLimit is configured.
• Span Attribute Content: Span attributes containing the Unicode replacement character U+FFFD (EF BF BD in hex) with values exceeding the configured AttributeValueLengthLimit.
• Logs/Telemetry: Exported trace data showing span attribute values longer than the configured limit, especially those containing U+FFFD sequences.
• Process Metrics: Gradual or sudden increase in heap memory usage of the instrumented process without a corresponding increase in legitimate workload, potentially indicating resource exhaustion attempts.

Upgrade go.opentelemetry.io/otel/sdk/trace to version 1.33.0 or later, which replaces the flawed safeTruncate/safeTruncateValidUTF8 logic with a corrected truncate function that properly handles U+FFFD (GitHub Release v1.33.0, Fix Commit). If immediate patching is not possible, implement input validation or filtering on span attributes to prevent the inclusion of U+FFFD (\uFFFD) in attribute values before they are passed to the SDK. Alternatively, consider reducing the AttributeValueLengthLimit to a more conservative value to limit the potential memory impact of any bypass.

The vulnerability was reported by pellared and analyzed by MrAlias (Tyler Yahn), both OpenTelemetry-Go contributors, who also authored the fix in PR #5997 (Fix PR #5997). The underlying bug was originally filed as a correctness issue (span attributes truncated by bytes rather than characters per the OTel specification) before its security implications were identified. Red Hat tracked the issue via Bugzilla (Red Hat CVE). No significant broader media coverage or social media discussion has been observed.