GO-2026-6262 - OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or comp

Severity: info · Published 2026-08-25

Technologies: github.com/opentofu/opentofu (Go). Vendors: Go.

Executive brief

OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers in github.com/opentofu/opentofu

Affected products

Go github.com/opentofu/opentofu

Related threats

OpenTofu denial of service in tofu init with malicious .zip archives
OpenTofu symlink following in provider cache directory
GO-2026-5558 - OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opento
GO-2026-5571 - OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu
GO-2026-5441 - OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/