Advisoriesby Ibis
OpenTofu security advisories
9 advisories · 1 critical or high in 12 months · latest Aug 20
9 advisories
OpenTofu: denial of serviceGHSA-22w5-2fxg-vrwxfixed in 1.11.9 +1## Summary If a symlink already exists under the `.terraform/providers`...CVE-2026-74796fixed in 1.10.10 +1OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URLGHSA-q7j3-v8qv-22vqfixed in 1.11.10 +1OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled serverGHSA-pxh5-6rrc-8rjvfixed in 1.11.8OpenTofu: denial of serviceGHSA-hw5x-4r37-72w7fixed in 1.11.6OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip formatCVE-2026-74797fixed in 1.11.4When OpenTofu is acting as a TLS client authenticating a certificate chain...GHSA-mjcp-gpgx-ggcgfixed in 1.10.8OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responsesGHSA-w2jf-268q-mrvhfixed in 1.10.7OpenTofu potential leaking of secret variable values when using static evaluation in v1.8CVE-2024-58375fixed in 1.8.3About OpenTofu
OpenTofu lets you declaratively manage your cloud infrastructure.
Packages watched: github.com/opentofu/opentofu (Go).