Security
فارسی
All products

github.com/opentofu/opentofu

Go · Package
9 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised serversGHSA-22W5-2FXG-VRWX · GO-2026-6262Version ranges need review. github.com/opentofu/opentofu Go Low Fix reported
OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip formatCVE-2026-74797 · GHSA-R92C-9C7F-3PJ8Version ranges need review. github.com/opentofu/opentofu Go Low Fix reported
OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled serverGHSA-PXH5-6RRC-8RJV · GO-2026-5558Version ranges need review. github.com/opentofu/opentofu Go Low Fix reported
OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responsesGHSA-W2JF-268Q-MRVH · GO-2025-4101Version ranges need review. github.com/opentofu/opentofu Go Low Fix reported
OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working treeCVE-2026-74796 · GHSA-WCMJ-X466-56MMVersion ranges need review. github.com/opentofu/opentofu Go Medium Fix reported
OpenTofu potential leaking of secret variable values when using static evaluation in v1.8CVE-2024-58375 · GHSA-WPR2-J6GR-PJW9Version ranges need review. github.com/opentofu/opentofu Go Low Fix reported
OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responsesGHSA-HW5X-4R37-72W7 · GO-2026-5441Version ranges need review. github.com/opentofu/opentofu Go Low Fix reported
OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URLGHSA-Q7J3-V8QV-22VQ · GO-2026-5571Version ranges need review. github.com/opentofu/opentofu Go High Fix reported
OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANsGHSA-MJCP-GPGX-GGCG · GO-2025-4224Version ranges need review. github.com/opentofu/opentofu Go Medium Fix reported