VDB
GO-2026-4352
GO-2026-4352
PUBLISHED
OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format in github.com/opentofu/opentofu
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | opentofu/opentofu | 0 |
Timeline
- Feb 2, 2026 CVE Published
- Aug 17, 2026 CVE Updated
References
- https://github.com/opentofu/opentofu/security/advisories/GHSA-r92c-9c7f-3pj8 advisory
- https://go.dev/issue/77102 url
- https://github.com/opentofu/opentofu/commit/f5d5cdf16615ea3c298e058b062951adb02805f3 fix
- https://github.com/opentofu/opentofu/pull/3689 fix
- https://github.com/opentofu/opentofu/releases/tag/v1.11.4 fix