Go Package Vulnerabilities

Open in search

Vulnerabilities associated with github.com/opentofu/opentofu.

Packages

Clear package

Showing 8 vulnerabilities on this page for github.com/opentofu/opentofu

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree

## Summary If a symlink already exists under the `.terraform/providers` directory where a provider package needs to be installed, `tofu init` would follow that symlink and install the new package content into it. If an attacker can coerce an operator into running `tofu init` in a directory whose contents are attacker-controlled, they can include such a symlink along with instruction to install an attacker-controlled provider package at the path of that symlink, which would then cause OpenTofu …

CWE-61Jun 23, 2026
CVSS-v3.1EPSS-PoCs0SignalsSTIX

OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL

### Impact Possible data exposure. #### Summary While downloading packages from a maliciously crafted URL, some git operations against that URL could allow arbitrary file read. This might allow disclosure of confidential information. #### Details OpenTofu relies on [go-getter](https://github.com/hashicorp/go-getter) for downloading packages like providers and modules. While doing so from a maliciously crafted URL, the operator could be affected by confidential information disclosure. The go-g…

CWE-1395Jun 19, 2026
CVSS-v3.1EPSS-PoCs0SignalsSTIX

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

### Impact Unauthenticated denial of service. ### Summary When installing provider or module packages from attacker-controlled servers, the server may cause `tofu init`to enter an infinite loop sending garbage data to that server. Those who depend on modules or providers served from untrusted third-party servers may experience denial of service due to `tofu init` failing to complete successfully. Other processes running on the same computer as OpenTofu may also fail or have their performance …

CWE-835May 20, 2026
CVSS-v3.1EPSS-PoCs0SignalsSTIX

OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses

### Impact Unauthenticated denial of service. ### Summary When installing module packages from attacker-controlled sources, `tofu init` may use unbounded memory, cause high CPU usage, or deadlock when encountering maliciously-crafted TLS certificate chains or tar archives. Those who depend on modules or providers served from untrusted third-party servers may experience denial of service due to `tofu init` failing to complete successfully. In the case of unbounded memory usage or high CPU usa…

CWE-1395Apr 14, 2026
CVSS-v3.1EPSS-PoCs0SignalsSTIX

OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format

### Impact Unauthenticated denial of service. ### Summary When installing module packages from attacker-controlled sources, `tofu init` may cause high CPU usage when encountering maliciously-crafted `.zip` archives for either provider or module distribution packages. Those who depend on modules or providers served from untrusted third-party servers may experience denial of service due to `tofu init` failing to complete in a timely manner. Other processes running on the same computer as OpenTof…

CWE-1395Jan 21, 2026
CVSS-v3.1EPSS-PoCs0SignalsSTIX

OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs

When OpenTofu is acting as a TLS client authenticating a certificate chain provided by a TLS server, an excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard [SANs](https://en.wikipedia.org/wiki/Public_key_certificate#Subject_Alternative_Name_certificate) in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com. ### Details When acting as a TLS c…

CWE-1395CWE-296Dec 9, 2025
CVSS-v3.1EPSS-PoCs0SignalsSTIX

OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses

### Impact Unauthenticated denial of service. ### Summary When installing module packages from attacker-controlled sources, `tofu init` may use unbounded memory, cause high CPU usage, or crash when encountering maliciously-crafted TLS certificate chains or tar archives. Those who depend on modules or providers served from untrusted third-party servers may experience denial of service due to `tofu init` failing to complete successfully. In the case of unbounded memory usage or high CPU usage,…

CWE-1395Nov 6, 2025
CVSS-v3.1EPSS-PoCs0SignalsSTIX

OpenTofu potential leaking of secret variable values when using static evaluation in v1.8

### Impact Users who have opted into static evaluation of module sources, versions, and backend configurations may be at risk of exposing sensitive variables and locals. This is a workflow that should not be possible and explicitly show errors. ### Workarounds Check that you are not using sensitive variables in module sources and versions, as well as backend configurations. The patch will add explicit errors and prevent this from being possible. ### Examples ```hcl variable "backend_path" { …

CWE-200Oct 3, 2024
CVSS-v4.0EPSS-PoCs0SignalsSTIX