Skip to content
OpenAdvisories

Package · Go

github.com/opentofu/opentofu

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Low 2.6
    GHSA-22w5-2fxg-vrwx

    OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers

    ### Impact Unauthenticated denial of service. ### Summary When OpenTofu performs requests against an untrusted (or compromised) third-party server or connects to an attacker-controlled server, the initial connection negotiation can produce high CPU usage, lea…

    github.com/opentofu/opentofu Go
  • Low 3.1
    CVE-2026-74797

    OpenTofu before 1.11.4 Denial of Service via malicious zip

    OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content s…

    opentofu opentofu github.com/opentofu/opentofu Go
  • Low 3.1
    GHSA-pxh5-6rrc-8rjv

    OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

    ### Impact Unauthenticated denial of service. ### Summary When installing provider or module packages from attacker-controlled servers, the server may cause `tofu init`to enter an infinite loop sending garbage data to that server. Those who depend on modules …

    github.com/opentofu/opentofu Go
  • Low 3.1
    GHSA-hw5x-4r37-72w7

    OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses

    ### Impact Unauthenticated denial of service. ### Summary When installing module packages from attacker-controlled sources, `tofu init` may use unbounded memory, cause high CPU usage, or deadlock when encountering maliciously-crafted TLS certificate chains or…

    github.com/opentofu/opentofu Go
  • Low 3.1
    GHSA-w2jf-268q-mrvh

    OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses

    ### Impact Unauthenticated denial of service. ### Summary When installing module packages from attacker-controlled sources, `tofu init` may use unbounded memory, cause high CPU usage, or crash when encountering maliciously-crafted TLS certificate chains or ta…

    github.com/opentofu/opentofu Go