OpenTelemetry-Go's sdk/trace/span.go component improperly handles the Unicode replacement character U+FFFD during attribute truncation for string and string-slice attributes. The safeTruncateValidUTF8 function treats this valid Unicode character as invalid UTF-8 and returns the original input without truncation, while strings.ToValidUTF8 leaves the character unchanged. Consequently, repeated truncation attempts can return oversized attribute values that exceed the configured AttributeValueLengthLimit. An attacker controlling span attribute content can exploit this to increase memory usage per span and degrade denial-of-service protections. The vulnerability affects versions >=1.10.0 and <1.33.0 and is resolved in version 1.33.0.

The vulnerability allows attackers who can control span attribute content to bypass attribute length limits, causing increased memory consumption per span. This can weaken denial-of-service protections in the instrumented process, potentially leading to resource exhaustion or degraded performance. There is no indication of remote code execution or privilege escalation. The CVSS 4.0 score is 5.1 (medium severity), reflecting local attack vector with low complexity and no user interaction required.

Upgrade OpenTelemetry-Go to version 1.33.0 or later where this issue is fixed. No other mitigations are indicated. Patch status is confirmed fixed in 1.33.0.