diff --git a/go.mod b/go.mod
index 5560a15f48..2ec6eca747 100644
--- a/go.mod
+++ b/go.mod
@@ -97,7 +97,7 @@ require (
 	go.etcd.io/bbolt v1.4.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0
-	go.opentelemetry.io/contrib/zpages v0.67.0
+	go.opentelemetry.io/contrib/zpages v0.68.0
 	go.opentelemetry.io/otel v1.43.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0
diff --git a/go.sum b/go.sum
index bec340ed1d..6fcc4aa94b 100644
--- a/go.sum
+++ b/go.sum
@@ -1300,8 +1300,8 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0/go.mod h1:Sje3i3MjSPKTSPvVWCaL8ugBzJwik3u4smCjUeuupqg=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
-go.opentelemetry.io/contrib/zpages v0.67.0 h1:cIUwWSVDovuLEbDIKreptjdxMuIhGiqwq0uL8YNaq1c=
-go.opentelemetry.io/contrib/zpages v0.67.0/go.mod h1:vK8fsYHgPYg4Z/XDbFSEvItSGZDbjWTvjBOu8+AiDhc=
+go.opentelemetry.io/contrib/zpages v0.68.0 h1:H5yrUwxPrbvhzdBxjQD+VXMtPjIBfp8NWNVvQT8E30M=
+go.opentelemetry.io/contrib/zpages v0.68.0/go.mod h1:sZGctYYO4UOHItj9bx3F+t/s+u1Fv8CHCJ5s2eR2cjU=
 go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
 go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
diff --git a/vendor/go.opentelemetry.io/contrib/zpages/tracez.go b/vendor/go.opentelemetry.io/contrib/zpages/tracez.go
index b0ca486d31..4f210e5325 100644
--- a/vendor/go.opentelemetry.io/contrib/zpages/tracez.go
+++ b/vendor/go.opentelemetry.io/contrib/zpages/tracez.go
@@ -41,6 +41,8 @@ const (
 	spanLatencyBucketQueryField = "zlatencybucket"
 	// maxTraceMessageLength is the maximum length of a message in tracez output.
 	maxTraceMessageLength = 1024
+
+	maxRequestBodySize = 1 << 20 // 1MB
 )
 
 type summaryTableData struct {
@@ -79,6 +81,8 @@ func NewTracezHandler(sp *SpanProcessor) http.Handler {
 // ServeHTTP implements the http.Handler and is capable of serving "tracez" HTTP requests.
 func (th *tracezHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+
+	r.Body = http.MaxBytesReader(w, r.Body, maxRequestBodySize)
 	if err := r.ParseForm(); err != nil {
 		w.WriteHeader(http.StatusBadRequest)
 		return
diff --git a/vendor/go.opentelemetry.io/contrib/zpages/version.go b/vendor/go.opentelemetry.io/contrib/zpages/version.go
index 14503a4a87..e0404e7be9 100644
--- a/vendor/go.opentelemetry.io/contrib/zpages/version.go
+++ b/vendor/go.opentelemetry.io/contrib/zpages/version.go
@@ -4,4 +4,4 @@
 package zpages // import "go.opentelemetry.io/contrib/zpages"
 
 // Version is the current release version of the zpages span processor.
-const Version = "0.67.0"
+const Version = "0.68.0"
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 630b3ae618..b00172aa40 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -2319,7 +2319,7 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/inte
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/request
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv
-# go.opentelemetry.io/contrib/zpages v0.67.0
+# go.opentelemetry.io/contrib/zpages v0.68.0
 ## explicit; go 1.25.0
 go.opentelemetry.io/contrib/zpages
 go.opentelemetry.io/contrib/zpages/internal