Skip to content
Fencer Intel
medium 5.3

CVE-2026-128085 json

opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes

published 17d ago modified yesterday also GHSA-q7gw-24fr-5p69 , EUVD-2026-125715

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnorm, sdk/log/internal/attrnorm, and trace/auto.go do not count valid U+FFFD replacement characters. This is a distinct incomplete-fix defect in the replacement truncation code introduced by the remediation for CVE-2026-81869. Values composed of or dominated by those characters can therefore exceed the configured character and memory bound in span, log-record, and auto-instrumentation trace attributes. Attacker-controlled telemetry attributes can increase retained memory and pipeline pressure, while confidentiality and integrity are not affected. This issue is fixed in version 1.47.0.

Patch / fix

  • go go.opentelemetry.io/otel/sdk 1.47.0
  • go go.opentelemetry.io/otel/sdk/log 1.47.0
  • go go.opentelemetry.io/otel/trace 1.47.0

Is CVE-2026-128085 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-128085 updated cvss 5.3

go.opentelemetry.io/otel/sdk: go.opentelemetry.io/otel/sdk/log: go.opentelemetry.io/otel/trace: OpenTelemetry-Go: Denial of Service via attribute truncation bypass using Unicode replacement characters

  • Red Hat Hardened Images dex 2.46.1-0.1.hum1, etcd 3.7.3-0.1.hum1, k6v1 1.8.2-0.3.hum1, k6v2 2.3.0-0.4.hum1, helm4 4.3.1-0.2.hum1, rclone 1.75.2-2.hum1, +39 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Ansible Automation Orchestrator 2026 ansible-automation-platform/automation-orchestrator-rhel9-operator, ansible-automation-platform/automation-orchestrator-temporal-rhel9, ansible-automation-platform/automation-orchestrator-operator-bundle Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai/assisted-installer-rhel9, rhai/assisted-installer-agent-rhel9, rhai/assisted-installer-controller-rhel9, assisted/agent-preinstall-image-builder-rhel9 Red Hat AWS Load Balancer Operator albo/aws-load-balancer-rhel9-operator, albo/aws-load-balancer-controller-rhel8 Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-waiters-rhel9, openshift-builds/openshift-builds-webhook-rhel9, openshift-builds/openshift-builds-rhel9-operator, openshift-builds/openshift-builds-waiters-rhel10, openshift-builds/openshift-builds-webhook-rhel10, openshift-builds/openshift-builds-rhel10-operator, +12 more Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9, cert-manager/cert-manager-istio-csr-rhel9, cert-manager/jetstack-cert-manager-acmesolver-rhel9 Red Hat Compliance Operator compliance/openshift-compliance-rhel8-operator, compliance/openshift-compliance-operator-bundle, compliance/openshift-compliance-must-gather-rhel8
    +33 more products
    Red Hat Confidential Compute Attestation build-of-trustee/trustee-rhel9-operator, agent-sandbox/agent-sandbox-rhel9-operator, build-of-trustee/trustee-must-gather-rhel9, openshift-sandboxed-containers/osc-monitor-rhel9, openshift-sandboxed-containers/osc-rhel9-operator, openshift-sandboxed-containers/osc-must-gather-rhel9, +3 more Red Hat Cost Management On Premise costmanagement/costmanagement-ingress-rhel9 Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9, cryostat/cryostat-rhel9-operator, cryostat/cryostat-grafana-dashboard-rhel9 Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9, +1 more Red Hat DPU kit for NVIDIA dpu-kit-for-nvidia/must-gather-rhel10, dpu-kit-for-nvidia/bluefield-ocp-layer-rhel10, dpu-kit-for-nvidia/dpf-hcp-provisioner-rhel10-operator Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9, exploit-intelligence/vulnerability-analysis-rhel9, exploit-intelligence/exploit-intelligence-operator-controller-rhel9 Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9, external-secrets-operator/external-secrets-operator-rhel9 Red Hat ExternalDNS Operator edo/external-dns-rhel8, edo/external-dns-rhel9, edo/external-dns-rhel9-operator Red Hat Fence Agents Remediation Operator workload-availability/fence-agents-remediation-rhel9-operator Red Hat File Integrity Operator compliance/openshift-file-integrity-rhel8-operator, compliance/openshift-file-integrity-operator-bundle Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9, gatekeeper/gatekeeper-rhel9-operator Red Hat Helm CLI for Red Hat OpenShift helm-cli/helm-cli-rhel9 Red Hat Job Set 1 job-set/jobset-rhel9, job-set/jobset-rhel9-operator Red Hat Job Set Tech Preview job-set/jobset-rhel9, job-set/jobset-rhel9-operator, job-set/jobset-operator-bundle Red Hat Kernel Module Management Operator for Red Hat Openshift kmm/kernel-module-management-rhel9-operator, kmm/kernel-module-management-must-gather-rhel9, kmm/kernel-module-management-hub-rhel9-operator, kmm/kernel-module-management-webhook-server-rhel9 Red Hat Kube Descheduler Operator kube-descheduler-operator/descheduler-rhel9, kube-descheduler-operator/kube-descheduler-rhel9-operator Red Hat Leader Worker Set leader-worker-set/lws-rhel9, leader-worker-set/lws-rhel9-operator Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/loki-rhel9-operator, openshift-logging/lokistack-gateway-rhel9, openshift-logging/cluster-logging-rhel9-operator Red Hat Logical Volume Manager Storage lvms4/topolvm-rhel9, lvms4/lvms-rhel9-operator, lvms4/lvms-operator-bundle, lvms4/lvms-must-gather-rhel9 Red Hat Machine Deletion Remediation Operator workload-availability/machine-deletion-remediation-rhel9-operator, workload-availability/machine-deletion-remediation-operator-bundle Red Hat MCP Lifecycle Operator mcp-lifecycle-operator-beta/mcp-lifecycle-rhel9-operator Red Hat MCP Server for Red Hat OpenShift openshift-mcp/openshift-mcp-server-rhel9, openshift-mcp-tech-preview/openshift-mcp-server-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-cli-rhel9, mta/mta-hub-rhel9, mta/mta-rhel9-operator, mta/mta-agent-java-rhel9, mta/mta-analyzer-addon-rhel9, mta/mta-solution-server-rhel9, +5 more Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-controller-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-rhel9-operator, migration-toolkit-virtualization/mtv-validation-rhel9, migration-toolkit-virtualization/mtv-must-gather-rhel9, migration-toolkit-virtualization/mtv-populator-controller-rhel9, migration-toolkit-virtualization/mtv-vsphere-copy-offload-populator-rhel9, migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9 Red Hat mirror registry for Red Hat OpenShift 3 openshift/mirror-registry-rhel9 Red Hat Multiarch Tuning Operator multiarch-tuning/multiarch-tuning-rhel9-operator, multiarch-tuning/multiarch-tuning-operator-bundle Red Hat Multicluster Engine for Kubernetes multicluster-engine/hive-rhel9, multicluster-engine/work-rhel9, multicluster-engine/maestro-rhel9, multicluster-engine/placement-rhel9, multicluster-engine/must-gather-rhel9, multicluster-engine/registration-rhel9, +26 more Red Hat Multicluster Engine for Kubernetes 5 multicluster-engine/hive-rhel9, multicluster-engine/work-rhel9, multicluster-engine/maestro-rhel9, multicluster-engine/placement-rhel9, multicluster-engine/must-gather-rhel9, multicluster-engine/registration-rhel9, +22 more Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9, multicluster-globalhub/multicluster-globalhub-manager-rhel9, multicluster-globalhub/multicluster-globalhub-rhel9-operator Red Hat Multicluster Global Hub 5 multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9, multicluster-globalhub/multicluster-globalhub-manager-rhel9, multicluster-globalhub/multicluster-globalhub-rhel9-operator Red Hat Network Observability Operator network-observability/network-observability-cli-rhel9, network-observability/network-observability-rhel9-operator, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9
    under investigation

62 more under investigation in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-14).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
go go.opentelemetry.io/otel/sdk
>=1.33.0, <1.47.0
1.47.0
go go.opentelemetry.io/otel/sdk/log
>=0.9.0, <1.47.0
1.47.0
go go.opentelemetry.io/otel/trace
>=1.35.0, <1.47.0
1.47.0

Affected products

  • open-telemetry opentelemetry-go
  • open-telemetry go.opentelemetry.io/otel/sdk

Classification

Weakness
  • CWE-135 Incorrect Calculation of Multi-Byte String Length
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of open-telemetry/opentelemetry-go published their own advisory on GitHub. Reviewed sources take precedence over it.