A vulnerability in go.opentelemetry.io/otel/sdk allows the AttributeValueLengthLimit truncation to be bypassed by attribute values composed entirely of valid U+FFFD (REPLACEMENT CHARACTER) runes. This occurs because the truncation logic incorrectly skips counting these runes, allowing values to exceed the configured length limit. The issue affects versions starting from v1.33.0 up to but not including v1.47.0, including the auto-instrumentation tracer introduced in v1.35.0. The flaw is a regression introduced by a previous fix and is distinct from the original issue fixed before v1.33.0. A patch is available in version 1.47.0.