# github.com/opentofu/opentofu (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-opentofu-opentofu Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-opentofu-opentofu.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 13 vulnerabilities in github.com/opentofu/opentofu (Go): 0 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, GO-2026-6262 - OpenTofu has high CPU usage when using K8S remote state backend…, was published on 25 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 4 - All time: 13 (0 critical, 0 exploited in the wild) ## About github.com/opentofu/opentofu (Go) Open-source infrastructure as code tool compatible with Terraform. ## Latest github.com/opentofu/opentofu (Go) vulnerabilities - [GO-2026-6262 - OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted…](https://junglewise.ai/threats/go-2026-6262-opentofu-has-high-cpu-usage-when-using-k8s-remote-state-fd0be1cd) (info, published 25 Aug 2026) - [CVE-2026-74797: OpenTofu denial of service in tofu init with malicious .zip archives](https://junglewise.ai/threats/cve-2026-74797-opentofu-denial-of-service-in-tofu-init-with-malicious-zip) (low, CVSS 3.1, published 16 Aug 2026) - [CVE-2026-74796: OpenTofu symlink following in provider cache directory](https://junglewise.ai/threats/cve-2026-74796-opentofu-symlink-following-in-provider-cache-directory) (medium, CVSS 6.1, published 16 Aug 2026) - [CVE-2024-58375: OpenTofu potential leaking of secret variable values when using static evaluation in v1.8](https://junglewise.ai/threats/cve-2024-58375-opentofu-potential-leaking-of-secret-variable-values-when-using) (high, CVSS 7.5, published 16 Aug 2026) - [GO-2026-5558 - OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled…](https://junglewise.ai/threats/go-2026-5558-opentofu-excessive-resource-usage-in-tofu-init-when-0d176cfc) (info, published 25 Jun 2026) - [GO-2026-5571 - OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in…](https://junglewise.ai/threats/go-2026-5571-opentofu-possible-arbitrary-file-read-during-certain-git-3b162031) (info, published 25 Jun 2026) - [GO-2026-5441 - OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with…](https://junglewise.ai/threats/go-2026-5441-opentofu-has-unbounded-memory-usage-high-cpu-usage-or-431b0bee) (info, published 25 Jun 2026) - [OpenTofu infinite loop in tofu init via malicious HTTP2 server](https://junglewise.ai/threats/opentofu-infinite-loop-in-tofu-init-via-malicious-http2-server-a5f837fb) (low, CVSS 3.1, published 20 May 2026) - [OpenTofu denial of service in tofu init via malicious dependencies](https://junglewise.ai/threats/opentofu-denial-of-service-in-tofu-init-via-malicious-dependencies-f7d4163e) (low, CVSS 3.1, published 14 Apr 2026) - [GO-2025-4224 - OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates…](https://junglewise.ai/threats/go-2025-4224-opentofu-incorrectly-validates-excluded-subdomain-39305594) (info, published 15 Dec 2025) - [OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs](https://junglewise.ai/threats/opentofu-incorrectly-validates-excluded-subdomain-constraint-in-9137dde6) (low, CVSS 3.1, published 9 Dec 2025) - [GO-2025-4101 - OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses…](https://junglewise.ai/threats/go-2025-4101-opentofu-affected-denials-of-service-in-tofu-init-with-f1f7952a) (info, published 17 Nov 2025) - [OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses](https://junglewise.ai/threats/opentofu-affected-denials-of-service-in-tofu-init-with-maliciously-218e1ccb) (low, CVSS 3.1, published 6 Nov 2025) ## Most severe github.com/opentofu/opentofu (Go) vulnerabilities - [CVE-2024-58375: OpenTofu potential leaking of secret variable values when using static evaluation in v1.8](https://junglewise.ai/threats/cve-2024-58375-opentofu-potential-leaking-of-secret-variable-values-when-using) (high, CVSS 7.5, published 16 Aug 2026) - [CVE-2026-74796: OpenTofu symlink following in provider cache directory](https://junglewise.ai/threats/cve-2026-74796-opentofu-symlink-following-in-provider-cache-directory) (medium, CVSS 6.1, published 16 Aug 2026) - [CVE-2026-74797: OpenTofu denial of service in tofu init with malicious .zip archives](https://junglewise.ai/threats/cve-2026-74797-opentofu-denial-of-service-in-tofu-init-with-malicious-zip) (low, CVSS 3.1, published 16 Aug 2026) - [OpenTofu infinite loop in tofu init via malicious HTTP2 server](https://junglewise.ai/threats/opentofu-infinite-loop-in-tofu-init-via-malicious-http2-server-a5f837fb) (low, CVSS 3.1, published 20 May 2026) - [OpenTofu denial of service in tofu init via malicious dependencies](https://junglewise.ai/threats/opentofu-denial-of-service-in-tofu-init-via-malicious-dependencies-f7d4163e) (low, CVSS 3.1, published 14 Apr 2026) - [OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs](https://junglewise.ai/threats/opentofu-incorrectly-validates-excluded-subdomain-constraint-in-9137dde6) (low, CVSS 3.1, published 9 Dec 2025) - [OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses](https://junglewise.ai/threats/opentofu-affected-denials-of-service-in-tofu-init-with-maliciously-218e1ccb) (low, CVSS 3.1, published 6 Nov 2025) - [GO-2026-6262 - OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted…](https://junglewise.ai/threats/go-2026-6262-opentofu-has-high-cpu-usage-when-using-k8s-remote-state-fd0be1cd) (info, published 25 Aug 2026) - [GO-2026-5571 - OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in…](https://junglewise.ai/threats/go-2026-5571-opentofu-possible-arbitrary-file-read-during-certain-git-3b162031) (info, published 25 Jun 2026) - [GO-2026-5558 - OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled…](https://junglewise.ai/threats/go-2026-5558-opentofu-excessive-resource-usage-in-tofu-init-when-0d176cfc) (info, published 25 Jun 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/opentofu/opentofu (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-opentofu-opentofu, 13 November 2026.