# OpenTofu infinite loop in tofu init via malicious HTTP2 server

Source: https://junglewise.ai/threats/opentofu-infinite-loop-in-tofu-init-via-malicious-http2-server-a5f837fb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-05-20

OpenTofu is an open-source tool used to manage and deploy infrastructure. A vulnerability exists where an attacker can cause the tool to freeze or consume excessive system resources when a user attempts to download infrastructure modules from a malicious server. This results in a denial of service, preventing the user from completing their deployment and potentially slowing down other applications on the same machine.

Technologies: [github.com/opentofu/opentofu (Go)](https://junglewise.ai/threats/technologies/github-com-opentofu-opentofu). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 20 May 2026.

**Which products and versions are affected?** github.com/opentofu/opentofu (Go) < 1.11.8.

**Is there a fix for This vulnerability?** A patch was published on 2026-05-20: Version 1.11.8 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run github.com/opentofu/opentofu (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

OpenTofu is vulnerable to an infinite loop in its HTTP/2 transport layer, inherited from the Go standard library (CVE-2026-33814). The issue occurs when a remote server sends a crafted HTTP/2 SETTINGS frame with SETTINGS_MAX_FRAME_SIZE set to zero. An attacker can exploit this by tricking a user into running 'tofu init' against a malicious module or provider registry. This causes the process to enter an infinite loop, depleting CPU resources and preventing the initialization from completing. The vulnerability is fixed in OpenTofu v1.11.8 by upgrading the underlying Go runtime to version 1.25.10.

## Affected products

- OpenTofu Project OpenTofu < 1.11.8

## Timeline

- 2026-05-11: other: Issue first reported via automated tools
- 2026-05-14: disclosed: Advisory published by OpenTofu Project
- 2026-05-20: patched: Version 1.11.8 released with fix

## References

- [https://github.com/opentofu/opentofu/security/advisories/GHSA-pxh5-6rrc-8rjv](https://github.com/opentofu/opentofu/security/advisories/GHSA-pxh5-6rrc-8rjv)
- [https://github.com/opentofu/opentofu/issues/4094](https://github.com/opentofu/opentofu/issues/4094)
- [https://github.com/opentofu/opentofu/pull/4098](https://github.com/opentofu/opentofu/pull/4098)
- [https://github.com/opentofu/opentofu/releases/tag/v1.11.8](https://github.com/opentofu/opentofu/releases/tag/v1.11.8)
- [https://api.github.com/repos/opentofu/opentofu/security-advisories/GHSA-pxh5-6rrc-8rjv](https://api.github.com/repos/opentofu/opentofu/security-advisories/GHSA-pxh5-6rrc-8rjv)

## Related threats

- [GO-2026-6262 - OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted…](https://junglewise.ai/threats/go-2026-6262-opentofu-has-high-cpu-usage-when-using-k8s-remote-state-fd0be1cd)
- [OpenTofu denial of service in tofu init with malicious .zip archives](https://junglewise.ai/threats/cve-2026-74797-opentofu-denial-of-service-in-tofu-init-with-malicious-zip)
- [OpenTofu symlink following in provider cache directory](https://junglewise.ai/threats/cve-2026-74796-opentofu-symlink-following-in-provider-cache-directory)
- [OpenTofu potential leaking of secret variable values when using static evaluation in v1.8](https://junglewise.ai/threats/cve-2024-58375-opentofu-potential-leaking-of-secret-variable-values-when-using)
- [GO-2026-5558 - OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled…](https://junglewise.ai/threats/go-2026-5558-opentofu-excessive-resource-usage-in-tofu-init-when-0d176cfc)