Executive brief
OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs
Affected products
- Go github.com/opentofu/opentofu
Junglewise Threat Intelligence
OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs
Severity: low · CVSS 3.1 · Published 2025-12-09
Technologies: github.com/opentofu/opentofu (Go). Vendors: Go.
Related threats
- GO-2026-6262 - OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or comp
- OpenTofu denial of service in tofu init with malicious .zip archives
- OpenTofu symlink following in provider cache directory
- GO-2026-5558 - OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opento
- GO-2026-5571 - OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu