Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 20 May 2026.

Which products and versions are affected?

github.com/opentofu/opentofu (Go) < 1.11.8.

Is there a fix for This vulnerability?

A patch was published on 2026-05-20: Version 1.11.8 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run github.com/opentofu/opentofu (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

OpenTofu infinite loop in tofu init via malicious HTTP2 server

Q: Is there a fix for This vulnerability?

A patch was published on 2026-05-20: Version 1.11.8 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run github.com/opentofu/opentofu (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: low · CVSS 3.1 · Published 2026-05-20

OpenTofu is an open-source tool used to manage and deploy infrastructure. A vulnerability exists where an attacker can cause the tool to freeze or consume excessive system resources when a user attempts to download infrastructure modules from a malicious server. This results in a denial of service, preventing the user from completing their deployment and potentially slowing down other applications on the same machine.

Technologies: github.com/opentofu/opentofu (Go). Vendors: Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 20 May 2026.
Which products and versions are affected?: github.com/opentofu/opentofu (Go) < 1.11.8.
Is there a fix for This vulnerability?: A patch was published on 2026-05-20: Version 1.11.8 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run github.com/opentofu/opentofu (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

OpenTofu is vulnerable to an infinite loop in its HTTP/2 transport layer, inherited from the Go standard library (CVE-2026-33814). The issue occurs when a remote server sends a crafted HTTP/2 SETTINGS frame with SETTINGS_MAX_FRAME_SIZE set to zero. An attacker can exploit this by tricking a user into running 'tofu init' against a malicious module or provider registry. This causes the process to enter an infinite loop, depleting CPU resources and preventing the initialization from completing. The vulnerability is fixed in OpenTofu v1.11.8 by upgrading the underlying Go runtime to version 1.25.10.

Affected products

OpenTofu Project OpenTofu < 1.11.8

Timeline

2026-05-11: other: Issue first reported via automated tools
2026-05-14: disclosed: Advisory published by OpenTofu Project
2026-05-20: patched: Version 1.11.8 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.