Junglewise Threat Intelligence

OpenTofu denial of service via untrusted server connections

Severity: low · CVSS 2.6 · Published 2026-08-20

Executive brief

OpenTofu is an infrastructure-as-code tool that manages cloud resources and states by connecting to remote servers. When connecting to an untrusted or compromised server, malicious actors can craft specially designed TLS certificates or HTTP responses that cause OpenTofu to consume excessive CPU resources, potentially making it unresponsive. This is an unauthenticated denial-of-service vulnerability that does not allow data theft or code execution.

Technical details

OpenTofu relies on Go's standard library for TLS certificate verification and HTTP request handling. The vulnerability is caused by two inefficiencies in Go itself: CVE-2026-27145 (quadratic complexity in crypto/x509 hostname parsing) and CVE-2026-42504 (quadratic complexity in mime header decoding). CVE-2026-27145 affects TLS certificate parsing when connecting to any untrusted server; CVE-2026-42504 specifically affects the K8S remote state backend. An unauthenticated remote attacker can exploit this by serving a maliciously crafted TLS certificate or HTTP response, causing quadratic-time parsing operations that exhaust CPU. No user interaction is strictly required for K8S backend exploitation, though the vulnerability applies to connections initiated by the operator. Patches are available in OpenTofu v1.11.9 and v1.12.2 (via Go 1.25.11 and 1.26.3); the v1.10 series remains vulnerable with no planned patch.

Affected products

  • OpenTofu OpenTofu < 1.11.9, >= 1.12.0-beta1 < 1.12.2, 1.10.x

Timeline

  • 2026-06-12: disclosed
  • 2026-08-20: advisory
  • 2026-06-12: patched: OpenTofu v1.11.9 and v1.12.2 released with patches

References

Related threats