CVE-2026-128085 is a vulnerability in the open-telemetry opentelemetry-go SDK affecting versions from 0.9.0, 1.33.0, and 1.35.0 up to but not including 1.47.0. The issue involves incorrect calculation of multi-byte string length where valid U+FFFD replacement characters are not counted in truncation logic. This allows attacker-controlled telemetry attributes to exceed configured memory and character limits, increasing memory retention and pipeline pressure. The vulnerability does not affect confidentiality or integrity. It is fixed in version 1.47.0.