VDB

GO-2026-6262

GO-2026-6262 PUBLISHED

Record from OSV · Published August 25, 2026

github.com/opentofu/opentofu is fixed in 1.12.2 and 1.11.9 (Go Modules)

OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers in github.com/opentofu/opentofu

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
github.com/opentofu/opentofuGo Modules1.12.2, 1.11.9
opentofu-1.12Wolfi1.12.6-r6
opentofu-1.11Wolfi1.11.14-r6
opentofu-1.11Chainguard1.11.14-r6
opentofu-1.12Chainguard1.12.6-r6

Affected products

VendorProductVersions
wolfiopentofu-1.120
wolfiopentofu-1.110
chainguardopentofu-1.110
github.comopentofu/opentofu0, 1.12.0-beta1
chainguardopentofu-1.120

Timeline

  • Aug 25, 2026 CVE Published
  • Aug 26, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GO-2026-6262
vulnetix vdb fixes GO-2026-6262

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2026-6262/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›