Executive brief
OpenTofu is an infrastructure-as-code tool used to provision and manage cloud resources. When installing provider or module dependencies via the tofu init command, OpenTofu can be tricked into consuming excessive CPU resources if an attacker controls a maliciously-crafted .zip archive served during installation, causing the process to hang and degrading overall system performance. This requires an attacker to convince an operator to add a dependency from a malicious source to their configuration.
Technical details
The vulnerability is an uncontrolled resource consumption issue (CWE-400) in OpenTofu's .zip archive extraction logic during the tofu init command. It stems from a defect in Go's standard library .zip implementation, which can cause excessive CPU usage when processing maliciously-crafted archives with specially-crafted file entries. The attack requires network access and user interaction (the operator must initiate tofu init with a dependency pointing to attacker-controlled content), and no authentication is necessary. An attacker can exploit this by serving a malicious .zip file when OpenTofu attempts to download provider or module packages, causing denial of service by preventing timely completion of initialization. The vulnerability was patched in OpenTofu v1.11.4, which was built against Go 1.25.6 containing an improved .zip extraction implementation.
Affected products
- OpenTofu OpenTofu before 1.11.4
Timeline
- 2026-01-21: disclosed: GitHub Security Advisory GHSA-r92c-9c7f-3pj8 published
- 2026-01-21: patched: OpenTofu v1.11.4 released with patch
- 2026-08-16: other: NVD entry published