UNKNOWN Go
OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/opentofu/opentofu
GO-2026-5441 · GHSA-hw5x-4r37-72w7
Published · Modified
Description
OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/opentofu/opentofu
References
- ADVISORY https://github.com/opentofu/opentofu/security/advisories/GHSA-hw5x-4r37-72w7
- FIX https://github.com/opentofu/opentofu/pull/3966
- REPORT https://github.com/opentofu/opentofu/issues/4029
- REPORT https://github.com/opentofu/opentofu/issues/4030
- REPORT https://github.com/opentofu/opentofu/issues/4031
- REPORT https://github.com/opentofu/opentofu/issues/4032
- WEB https://github.com/opentofu/opentofu/releases/tag/v1.11.6
Ready to move
Start Securing
Free, no credit card | First findings in minutes