# GO-2026-5441 - OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with…

Source: https://junglewise.ai/threats/go-2026-5441-opentofu-has-unbounded-memory-usage-high-cpu-usage-or-431b0bee  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-06-25

OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/opentofu/opentofu

Technologies: [github.com/opentofu/opentofu (Go)](https://junglewise.ai/threats/technologies/github-com-opentofu-opentofu). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 25 June 2026.

**Which products and versions are affected?** github.com/opentofu/opentofu (Go) SEMVER:introduced=0,fixed=1.11.6.

**Is there a fix for This vulnerability?** Yes. github.com/opentofu/opentofu (Go): upgrade to 1.11.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run github.com/opentofu/opentofu (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/opentofu/opentofu (Go): upgrade to 1.11.6 or later

  ```sh
  go get github.com/opentofu/opentofu@v1.11.6
  ```


## Affected products

- github.com/opentofu/opentofu (Go) SEMVER:introduced=0,fixed=1.11.6

## Related threats

- [GO-2026-6262 - OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted…](https://junglewise.ai/threats/go-2026-6262-opentofu-has-high-cpu-usage-when-using-k8s-remote-state-fd0be1cd)
- [OpenTofu denial of service in tofu init with malicious .zip archives](https://junglewise.ai/threats/cve-2026-74797-opentofu-denial-of-service-in-tofu-init-with-malicious-zip)
- [OpenTofu symlink following in provider cache directory](https://junglewise.ai/threats/cve-2026-74796-opentofu-symlink-following-in-provider-cache-directory)
- [OpenTofu potential leaking of secret variable values when using static evaluation in v1.8](https://junglewise.ai/threats/cve-2024-58375-opentofu-potential-leaking-of-secret-variable-values-when-using)
- [GO-2026-5558 - OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled…](https://junglewise.ai/threats/go-2026-5558-opentofu-excessive-resource-usage-in-tofu-init-when-0d176cfc)