OpenTofu denial of service in tofu init via malicious dependencies

Severity: low · CVSS 3.1 · Published 2026-04-14

OpenTofu, an open-source infrastructure-as-code tool, is susceptible to a denial-of-service condition during the initialization process. If a user is convinced to download modules or providers from a malicious server, the attacker can trigger excessive memory and CPU usage or cause the application to freeze. This can disrupt infrastructure deployment workflows and potentially impact the performance of other applications running on the same system, though it does not allow for data theft or unauthorized code execution.

Technologies: github.com/opentofu/opentofu (Go), OpenTofu. Vendors: Go, OpenTofu.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Low severity, with a CVSS score of 3.1, published 14 April 2026.
Which products and versions are affected?
github.com/opentofu/opentofu (Go) < 1.11.6; OpenTofu < 1.11.6.
Is there a fix for This vulnerability?
A patch was published on 2026-04-14: Fixed in version 1.11.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run github.com/opentofu/opentofu (Go) or OpenTofu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

OpenTofu is affected by several upstream vulnerabilities in the Go standard library (specifically in crypto/x509, crypto/tls, and archive/tar) when built with older versions of Go. An attacker can trigger unbounded memory allocation, high CPU usage, or deadlocks by serving maliciously crafted TLS certificate chains or tar archives during the dependency installation phase of 'tofu init'. The attack requires the victim to attempt to install a module or provider from an attacker-controlled HTTPS server. These issues are addressed in OpenTofu v1.11.6 by upgrading the build environment to Go 1.25.9. Versions 1.9 and 1.10 remain affected as they are built with older Go toolchains to maintain legacy OS support.

Affected products

  • OpenTofu OpenTofu < 1.11.6

Timeline

  • 2026-04-13: disclosed
  • 2026-04-14: advisory
  • 2026-04-14: patched: Fixed in version 1.11.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.