Executive brief
OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses
Affected products
- Go github.com/opentofu/opentofu
Junglewise Threat Intelligence
OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses
Severity: low · CVSS 3.1 · Published 2026-04-14
Technologies: github.com/opentofu/opentofu (Go). Vendors: Go.
Related threats
- GO-2026-6262 - OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or comp
- OpenTofu denial of service in tofu init with malicious .zip archives
- OpenTofu symlink following in provider cache directory
- GO-2026-5558 - OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opento
- GO-2026-5571 - OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu