Read the docs
TI-2026-52561 Aliases CVE-2026-74797GHSA-3vh9-9frp-jhqv

OpenTofu before 1.11.4 Denial of Service via malicious zip

Priority LOW 12CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00283 20th percentileScored 2026-11-07
Fix Fixed opentofu (opentofu): 1.11.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
opentofuopentofubefore 1.11.41.11.4Patch availableCNA
  • opentofu Vendoropentofu Affected before 1.11.4 Fixed in 1.11.4 Patch available CNA

Remediation

  • Fix · CNA opentofu (opentofu) Fixed in 1.11.4

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-74797
  2. 2026-10-03 Alias added: GHSA-3vh9-9frp-jhqv

References

Advisory 1

  • TI-2024-38456 OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation CVSS 4.0HIGH 8.7
  • TI-2026-52560 OpenTofu before 1.11.7 Symlink Following Path Traversal CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences