VDB
GHSA-w2jf-268q-mrvh
GHSA-w2jf-268q-mrvh
PUBLISHED
CVSS 3.0999999046325684 LOW
OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses
Risk Scores
CVSS 3.1
3.0999999046325684
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | opentofu/opentofu | 0 |
| github.com | opentofu/opentofu | 0 |
| Go | github.com/opentofu/opentofu | 0 |
| wolfi | opentofu-1.10 | 0 |
| chainguard | opentofu-1.10 | 0 |
Timeline
- Nov 6, 2025 CVE Published
References
- https://github.com/opentofu/opentofu/security/advisories/GHSA-w2jf-268q-mrvh url
- https://github.com/opentofu/opentofu product
- https://www.cve.org/CVERecord?id=CVE-2025-58183 url
- https://www.cve.org/CVERecord?id=CVE-2025-58185 url
- https://www.cve.org/CVERecord?id=CVE-2025-58187 url
- https://www.cve.org/CVERecord?id=CVE-2025-58188 url
- GitHub Advisory GHSA-w2jf-268q-mrvh vendor-advisory
- https://github.com/opentofu/opentofu/issues/3465 discussion
- https://github.com/opentofu/opentofu/issues/3458 discussion
- https://github.com/opentofu/opentofu/issues/3462 discussion
- https://github.com/opentofu/opentofu/issues/3464 discussion
- https://github.com/opentofu/opentofu/pull/3467 fix
- https://github.com/opentofu/opentofu/releases/tag/v1.10.7 fix