VDB
GO-2025-4101
GO-2025-4101
PUBLISHED
OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses in github.com/opentofu/opentofu
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | opentofu/opentofu | 0 |
Timeline
- Nov 17, 2025 CVE Published
- Feb 4, 2026 CVE Updated
References
- https://www.cve.org/CVERecord?id=CVE-2025-58185 url
- https://www.cve.org/CVERecord?id=CVE-2025-58187 url
- https://github.com/opentofu/opentofu/security/advisories/GHSA-w2jf-268q-mrvh advisory
- https://www.cve.org/CVERecord?id=CVE-2025-58183 url
- https://www.cve.org/CVERecord?id=CVE-2025-58188 url
- https://github.com/opentofu/opentofu/issues/3465 discussion
- https://github.com/opentofu/opentofu/pull/3467 fix
- https://github.com/opentofu/opentofu/releases/tag/v1.10.7 fix
- https://github.com/opentofu/opentofu/issues/3462 discussion
- https://github.com/opentofu/opentofu/issues/3458 discussion
- https://github.com/opentofu/opentofu/issues/3464 discussion