EUVD-2026-59962
GHSA-3vh9-9frp-jhqv
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with high complexity and required user interaction to add attacker-controlled dependency; strictly availability-only impact with no confidentiality or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process.
AnalysisAI
Denial of service in OpenTofu's tofu init command allows an attacker who controls a provider or module registry to cause excessive CPU consumption on an operator's machine by serving a maliciously crafted .zip archive during dependency installation. All OpenTofu versions before 1.11.4 are affected; the root cause is a flaw in Go's standard library zip implementation, resolved in Go 1.25.6. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites must both be satisfied: first, the attacker must control a server or registry capable of serving `.zip` archives to OpenTofu during provider or module installation; second, the targeted operator must have already added a dependency in their OpenTofu configuration that points to the attacker-controlled source, and then must run `tofu init`. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.3 (AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) accurately represents real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a typosquatted or dependency-confusion module on a public OpenTofu registry and publishes a `.zip` archive crafted to trigger Go's zip parser into consuming unbounded CPU cycles. After convincing a developer or CI pipeline - via a misleading README reference, a compromised upstream recommendation, or a typosquatted package name - to add the malicious source to their OpenTofu configuration, the next `tofu init` execution causes the operator's machine or build runner to enter high CPU saturation, stalling infrastructure provisioning pipelines. … |
| Remediation | Upgrade to OpenTofu v1.11.4, which resolves the vulnerability by compiling against Go 1.25.6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today