Opentofu
Monthly
Denial of service in OpenTofu's `tofu init` command allows an attacker who controls a provider or module registry to cause excessive CPU consumption on an operator's machine by serving a maliciously crafted `.zip` archive during dependency installation. All OpenTofu versions before 1.11.4 are affected; the root cause is a flaw in Go's standard library zip implementation, resolved in Go 1.25.6. No public exploit has been identified and this vulnerability is absent from CISA KEV; the low CVSS 4.0 score of 2.3 appropriately reflects the high complexity and mandatory social engineering prerequisite.
OpenTofu's provider cache installer in all versions before 1.11.7 (and 1.10.x before 1.10.10) writes provider package contents to arbitrary filesystem locations when a malicious symlink is pre-positioned inside the .terraform/providers directory, allowing files controlled by the attacker to be placed anywhere the OpenTofu process has write permission. If an attacker can control the contents of a working directory — for instance through a malicious git repository, shared filesystem, or coerced developer workflow — they can include a crafted symlink pointing to a sensitive path outside the working tree, and a subsequent `tofu init` will follow that symlink and overwrite its target with attacker-supplied provider package content. No public exploit has been identified at time of analysis and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog; vendor-released patches for both active release branches are available.
Denial of service in OpenTofu's `tofu init` command allows an attacker who controls a provider or module registry to cause excessive CPU consumption on an operator's machine by serving a maliciously crafted `.zip` archive during dependency installation. All OpenTofu versions before 1.11.4 are affected; the root cause is a flaw in Go's standard library zip implementation, resolved in Go 1.25.6. No public exploit has been identified and this vulnerability is absent from CISA KEV; the low CVSS 4.0 score of 2.3 appropriately reflects the high complexity and mandatory social engineering prerequisite.
OpenTofu's provider cache installer in all versions before 1.11.7 (and 1.10.x before 1.10.10) writes provider package contents to arbitrary filesystem locations when a malicious symlink is pre-positioned inside the .terraform/providers directory, allowing files controlled by the attacker to be placed anywhere the OpenTofu process has write permission. If an attacker can control the contents of a working directory — for instance through a malicious git repository, shared filesystem, or coerced developer workflow — they can include a crafted symlink pointing to a sensitive path outside the working tree, and a subsequent `tofu init` will follow that symlink and overwrite its target with attacker-supplied provider package content. No public exploit has been identified at time of analysis and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog; vendor-released patches for both active release branches are available.