Junglewise Threat Intelligence

OpenTofu infinite loop in tofu init via malicious HTTP2 server

Severity: low · CVSS 3.1 · Published 2026-05-20

Executive brief

OpenTofu is an open-source tool used to manage and deploy infrastructure. A vulnerability exists where an attacker can cause the tool to freeze or consume excessive system resources when a user attempts to download infrastructure modules from a malicious server. This results in a denial of service, preventing the user from completing their deployment and potentially slowing down other applications on the same machine.

Technical details

OpenTofu is vulnerable to an infinite loop in its HTTP/2 transport layer, inherited from the Go standard library (CVE-2026-33814). The issue occurs when a remote server sends a crafted HTTP/2 SETTINGS frame with SETTINGS_MAX_FRAME_SIZE set to zero. An attacker can exploit this by tricking a user into running 'tofu init' against a malicious module or provider registry. This causes the process to enter an infinite loop, depleting CPU resources and preventing the initialization from completing. The vulnerability is fixed in OpenTofu v1.11.8 by upgrading the underlying Go runtime to version 1.25.10.

Affected products

  • OpenTofu Project OpenTofu < 1.11.8

Timeline

  • 2026-05-11: other: Issue first reported via automated tools
  • 2026-05-14: disclosed: Advisory published by OpenTofu Project
  • 2026-05-20: patched: Version 1.11.8 released with fix

References

Related threats