# OpenTofu denial of service via untrusted server connections

Source: https://junglewise.ai/threats/opentofu-denial-of-service-via-untrusted-server-connections-9195aa10  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 2.6 · Published 2026-08-20

OpenTofu is an infrastructure-as-code tool that manages cloud resources and states by connecting to remote servers. When connecting to an untrusted or compromised server, malicious actors can craft specially designed TLS certificates or HTTP responses that cause OpenTofu to consume excessive CPU resources, potentially making it unresponsive. This is an unauthenticated denial-of-service vulnerability that does not allow data theft or code execution.

Technologies: [OpenTofu](https://junglewise.ai/threats/technologies/opentofu). Vendors: [OpenTofu](https://junglewise.ai/threats/vendors/opentofu).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 2.6, published 20 August 2026.

**Which products and versions are affected?** OpenTofu < 1.11.9, >= 1.12.0-beta1 < 1.12.2, 1.10.x.

**Is there a fix for This vulnerability?** A patch was published on 2026-06-12: OpenTofu v1.11.9 and v1.12.2 released with patches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run OpenTofu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

OpenTofu relies on Go's standard library for TLS certificate verification and HTTP request handling. The vulnerability is caused by two inefficiencies in Go itself: CVE-2026-27145 (quadratic complexity in crypto/x509 hostname parsing) and CVE-2026-42504 (quadratic complexity in mime header decoding). CVE-2026-27145 affects TLS certificate parsing when connecting to any untrusted server; CVE-2026-42504 specifically affects the K8S remote state backend. An unauthenticated remote attacker can exploit this by serving a maliciously crafted TLS certificate or HTTP response, causing quadratic-time parsing operations that exhaust CPU. No user interaction is strictly required for K8S backend exploitation, though the vulnerability applies to connections initiated by the operator. Patches are available in OpenTofu v1.11.9 and v1.12.2 (via Go 1.25.11 and 1.26.3); the v1.10 series remains vulnerable with no planned patch.

## Affected products

- OpenTofu OpenTofu < 1.11.9, >= 1.12.0-beta1 < 1.12.2, 1.10.x

## Timeline

- 2026-06-12: disclosed
- 2026-08-20: advisory
- 2026-06-12: patched: OpenTofu v1.11.9 and v1.12.2 released with patches

## References

- [https://github.com/opentofu/opentofu/security/advisories/GHSA-22w5-2fxg-vrwx](https://github.com/opentofu/opentofu/security/advisories/GHSA-22w5-2fxg-vrwx)
- [https://github.com/opentofu/opentofu/issues/4242](https://github.com/opentofu/opentofu/issues/4242)
- [https://github.com/opentofu/opentofu/issues/4243](https://github.com/opentofu/opentofu/issues/4243)
- [https://github.com/opentofu/opentofu/issues/4244](https://github.com/opentofu/opentofu/issues/4244)
- [https://github.com/opentofu/opentofu/releases/tag/v1.11.9](https://github.com/opentofu/opentofu/releases/tag/v1.11.9)
- [https://github.com/opentofu/opentofu/releases/tag/v1.12.2](https://github.com/opentofu/opentofu/releases/tag/v1.12.2)

## Related threats

- [OpenTofu denial of service in tofu init with malicious .zip archives](https://junglewise.ai/threats/cve-2026-74797-opentofu-denial-of-service-in-tofu-init-with-malicious-zip)
- [OpenTofu symlink following in provider cache directory](https://junglewise.ai/threats/cve-2026-74796-opentofu-symlink-following-in-provider-cache-directory)
- [OpenTofu arbitrary file read via malicious git URL](https://junglewise.ai/threats/opentofu-arbitrary-file-read-via-malicious-git-url-018b3ffb)
- [OpenTofu denial of service in tofu init via malicious dependencies](https://junglewise.ai/threats/opentofu-denial-of-service-in-tofu-init-via-malicious-dependencies-f7d4163e)