MEDIUM5.1
GO-2026-6616
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation in go.opentelemetry.io/otel/sdk
Quick fix
GO-2026-6616 — go.opentelemetry.io/otel/sdk: upgrade to the fixed version with the command below.
go get go.opentelemetry.io/otel/sdk@v1.33.0Details
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation in go.opentelemetry.io/otel/sdk
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/go.opentelemetry.io/otel/sdk
Introduced in:
1.10.0Fixed in: 1.33.0Fix
go get go.opentelemetry.io/otel/sdk@v1.33.0References
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8[ADVISORY]
- https://github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a[WEB]
- https://github.com/open-telemetry/opentelemetry-go/issues/5996[WEB]
- https://github.com/open-telemetry/opentelemetry-go/pull/5997[WEB]
- https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.33.0[WEB]