GO-2025-4224 - OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs in github.com/ope

Severity: info · Published 2025-12-15

Technologies: github.com/opentofu/opentofu (Go). Vendors: Go.

Executive brief

OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs in github.com/opentofu/opentofu

Affected products

Go github.com/opentofu/opentofu

Related threats

GO-2026-6262 - OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or comp
OpenTofu denial of service in tofu init with malicious .zip archives
OpenTofu symlink following in provider cache directory
GO-2026-5558 - OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opento
GO-2026-5571 - OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu