Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-08-16T13:14:19 github.com/opentofu/opentofu: OpenTofu: Denial of Service via malicious zip archives 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CWE-400

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process.

A flaw was found in OpenTofu. A remote attacker could exploit this vulnerability by providing maliciously-crafted .zip archives during the `tofu init` command, which is used for provider or module package initialization. This could lead to excessive CPU usage, causing a Denial of Service (DoS) by degrading system performance and preventing the completion of the initialization process.

This Low impact denial of service vulnerability in OpenTofu affects the `tofu init` command when processing maliciously-crafted `.zip` archives. Exploitation requires an attacker to provide a malicious archive, necessitating user interaction or a compromised dependency supply chain, which limits the attack surface in Red Hat environments where `tofu init` is typically executed in controlled development or CI/CD pipelines. Red Hat Hardened Images Not affected hi/opentofu Red Hat Hardened Images Not affected opentofu1.10 Red Hat Hardened Images Not affected opentofu1.11 Red Hat Hardened Images Not affected opentofu1.12 https://www.cve.org/CVERecord?id=CVE-2026-74797 https://nvd.nist.gov/vuln/detail/CVE-2026-74797 https://github.com/opentofu/opentofu/security/advisories/GHSA-r92c-9c7f-3pj8 https://www.vulncheck.com/advisories/opentofu-before-denial-of-service-via-malicious-zip