OpenTofu denial of service in tofu init via malicious dependencies

Severity: low · CVSS 3.1 · Published 2026-04-14

Executive brief

OpenTofu, an open-source infrastructure-as-code tool, is susceptible to a denial-of-service condition during the initialization process. If a user is convinced to download modules or providers from a malicious server, the attacker can trigger excessive memory and CPU usage or cause the application to freeze. This can disrupt infrastructure deployment workflows and potentially impact the performance of other applications running on the same system, though it does not allow for data theft or unauthorized code execution.

Technical details

OpenTofu is affected by several upstream vulnerabilities in the Go standard library (specifically in crypto/x509, crypto/tls, and archive/tar) when built with older versions of Go. An attacker can trigger unbounded memory allocation, high CPU usage, or deadlocks by serving maliciously crafted TLS certificate chains or tar archives during the dependency installation phase of 'tofu init'. The attack requires the victim to attempt to install a module or provider from an attacker-controlled HTTPS server. These issues are addressed in OpenTofu v1.11.6 by upgrading the build environment to Go 1.25.9. Versions 1.9 and 1.10 remain affected as they are built with older Go toolchains to maintain legacy OS support.

OpenTofu denial of service in tofu init via malicious dependencies

Executive brief

Technical details

Affected products

Timeline

References

Related threats