OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Impact Unauthenticated denial of service. Summary When installing module packages from attacker-controlled sources, tofu init may use unbounded memory, cause high CPU usage, or deadlock when encountering maliciously-crafted TLS certificate chains or tar archives. Those who depend on modules or providers served from untrusted third-party servers may experience denial of service due to tofu init failing to complete successfully. In the case of unbounded memory usage or high CPU usage, other processes running on the same computer as OpenTofu may also fail or have their performance degraded due to the depletion of shared system resources. These vulnerabilities do not permit arbitrary code execution or allow disclosure of confidential information. Details OpenTofu relies on third-party implementations of TLS certificate verification and tar archive extraction from the standard library of the Go programming language. The Go project has recently published the following advisories for those…

Published by the source

14 Apr 2026, 23:34 UTC

Last modified by the source

14 Apr 2026, 23:34 UTC

Source last checked

26 Oct 2026, 15:19 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-hw5x-4r37-72w7

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-hw5x-4r37-72w7

Advisory: OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses
IDs: GHSA-hw5x-4r37-72w7
Record: https://patchnext.com/advisories/ghsa-hw5x-4r37-72w7 (revision 1, source checked 26 Oct 2026, 15:19 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Low (CVSS 3.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/opentofu/opentofu 1.11.6. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/opentofu/opentofu: affected < 1.11.6; fixed in 1.11.6

## Suggested inspection (read-only)
- Go github.com/opentofu/opentofu: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/opentofu/opentofu.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-hw5x-4r37-72w7 (GitHub-reviewed advisory GHSA-hw5x-4r37-72w7 lists affected ranges: Go github.com/opentofu/opentofu >=0 <1.11.6)

Commands are suggestions: review each one before running it.