Is CVE-2026-74797 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74797 being exploited in the wild.

How severe is CVE-2026-74797?

Low severity, with a CVSS score of 3.1, published 16 August 2026.

Which products and versions are affected?

github.com/opentofu/opentofu (Go) SEMVER:introduced=0,fixed=1.11.4; OpenTofu before 1.11.4.

Is there a fix for CVE-2026-74797?

Yes. github.com/opentofu/opentofu (Go): upgrade to 1.11.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-74797 attacked?

It is attacked over the network.

Am I affected by CVE-2026-74797?

Check whether you run github.com/opentofu/opentofu (Go) or OpenTofu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74797: OpenTofu denial of service in tofu init with malicious .zip archives

CVE-2026-74797 · Severity: low · CVSS 3.1 · Published 2026-08-16

OpenTofu is an infrastructure-as-code tool used to provision and manage cloud resources. When installing provider or module dependencies via the tofu init command, OpenTofu can be tricked into consuming excessive CPU resources if an attacker controls a maliciously-crafted .zip archive served during installation, causing the process to hang and degrading overall system performance. This requires an attacker to convince an operator to add a dependency from a malicious source to their configuration.

Technologies: github.com/opentofu/opentofu (Go), OpenTofu. Vendors: Go, OpenTofu.

Quick answers

Is CVE-2026-74797 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74797 being exploited in the wild.
How severe is CVE-2026-74797?: Low severity, with a CVSS score of 3.1, published 16 August 2026.
Which products and versions are affected?: github.com/opentofu/opentofu (Go) SEMVER:introduced=0,fixed=1.11.4; OpenTofu before 1.11.4.
Is there a fix for CVE-2026-74797?: Yes. github.com/opentofu/opentofu (Go): upgrade to 1.11.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74797 attacked?: It is attacked over the network.
Am I affected by CVE-2026-74797?: Check whether you run github.com/opentofu/opentofu (Go) or OpenTofu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/opentofu/opentofu (Go): upgrade to 1.11.4 or later
```
go get github.com/opentofu/opentofu@v1.11.4
```

Technical details

The vulnerability is an uncontrolled resource consumption issue (CWE-400) in OpenTofu's .zip archive extraction logic during the tofu init command. It stems from a defect in Go's standard library .zip implementation, which can cause excessive CPU usage when processing maliciously-crafted archives with specially-crafted file entries. The attack requires network access and user interaction (the operator must initiate tofu init with a dependency pointing to attacker-controlled content), and no authentication is necessary. An attacker can exploit this by serving a malicious .zip file when OpenTofu attempts to download provider or module packages, causing denial of service by preventing timely completion of initialization. The vulnerability was patched in OpenTofu v1.11.4, which was built against Go 1.25.6 containing an improved .zip extraction implementation.

Affected products

OpenTofu OpenTofu before 1.11.4

Identifiers

CVE-2026-74797
GHSA-r92c-9c7f-3pj8
GO-2026-4352

Timeline

2026-01-21: disclosed: GitHub Security Advisory GHSA-r92c-9c7f-3pj8 published
2026-01-21: patched: OpenTofu v1.11.4 released with patch
2026-08-16: other: NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.