# CVE-2026-74797: OpenTofu denial of service in tofu init with malicious .zip archives

Source: https://junglewise.ai/threats/cve-2026-74797-opentofu-denial-of-service-in-tofu-init-with-malicious-zip  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-74797 · Severity: low · CVSS 3.1 · Published 2026-08-16

OpenTofu is an infrastructure-as-code tool used to provision and manage cloud resources. When installing provider or module dependencies via the tofu init command, OpenTofu can be tricked into consuming excessive CPU resources if an attacker controls a maliciously-crafted .zip archive served during installation, causing the process to hang and degrading overall system performance. This requires an attacker to convince an operator to add a dependency from a malicious source to their configuration.

Technologies: [github.com/opentofu/opentofu (Go)](https://junglewise.ai/threats/technologies/github-com-opentofu-opentofu), [OpenTofu](https://junglewise.ai/threats/technologies/opentofu). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OpenTofu](https://junglewise.ai/threats/vendors/opentofu).

## Quick answers

**Is CVE-2026-74797 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-74797 being exploited in the wild.

**How severe is CVE-2026-74797?** Low severity, with a CVSS score of 3.1, published 16 August 2026.

**Which products and versions are affected?** github.com/opentofu/opentofu (Go) SEMVER:introduced=0,fixed=1.11.4; OpenTofu before 1.11.4.

**Is there a fix for CVE-2026-74797?** Yes. github.com/opentofu/opentofu (Go): upgrade to 1.11.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-74797 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-74797?** Check whether you run github.com/opentofu/opentofu (Go) or OpenTofu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/opentofu/opentofu (Go): upgrade to 1.11.4 or later

  ```sh
  go get github.com/opentofu/opentofu@v1.11.4
  ```


## Technical details

The vulnerability is an uncontrolled resource consumption issue (CWE-400) in OpenTofu's .zip archive extraction logic during the tofu init command. It stems from a defect in Go's standard library .zip implementation, which can cause excessive CPU usage when processing maliciously-crafted archives with specially-crafted file entries. The attack requires network access and user interaction (the operator must initiate tofu init with a dependency pointing to attacker-controlled content), and no authentication is necessary. An attacker can exploit this by serving a malicious .zip file when OpenTofu attempts to download provider or module packages, causing denial of service by preventing timely completion of initialization. The vulnerability was patched in OpenTofu v1.11.4, which was built against Go 1.25.6 containing an improved .zip extraction implementation.

## Affected products

- OpenTofu OpenTofu before 1.11.4

## Identifiers

- CVE-2026-74797
- GHSA-r92c-9c7f-3pj8
- GO-2026-4352

## Timeline

- 2026-01-21: disclosed: GitHub Security Advisory GHSA-r92c-9c7f-3pj8 published
- 2026-01-21: patched: OpenTofu v1.11.4 released with patch
- 2026-08-16: other: NVD entry published

## References

- [https://github.com/opentofu/opentofu/security/advisories/GHSA-r92c-9c7f-3pj8](https://github.com/opentofu/opentofu/security/advisories/GHSA-r92c-9c7f-3pj8)
- [https://www.vulncheck.com/advisories/opentofu-before-denial-of-service-via-malicious-zip](https://www.vulncheck.com/advisories/opentofu-before-denial-of-service-via-malicious-zip)

## Related threats

- [GO-2026-6262 - OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted…](https://junglewise.ai/threats/go-2026-6262-opentofu-has-high-cpu-usage-when-using-k8s-remote-state-fd0be1cd)
- [OpenTofu denial of service via untrusted server connections](https://junglewise.ai/threats/opentofu-denial-of-service-via-untrusted-server-connections-9195aa10)
- [OpenTofu symlink following in provider cache directory](https://junglewise.ai/threats/cve-2026-74796-opentofu-symlink-following-in-provider-cache-directory)
- [OpenTofu potential leaking of secret variable values when using static evaluation in v1.8](https://junglewise.ai/threats/cve-2024-58375-opentofu-potential-leaking-of-secret-variable-values-when-using)
- [GO-2026-5558 - OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled…](https://junglewise.ai/threats/go-2026-5558-opentofu-excessive-resource-usage-in-tofu-init-when-0d176cfc)