Description

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-16T14:16:57.930Z",
  "pubdate": "2026-08-16T14:16:57.930Z",
  "executiveSummary": "OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages.\nThe vulnerability allows an attacker controlling the content of a .zip archive served during dependency installation to trigger excessive CPU usage.\nThis behavior degrades system performance and prevents the timely completion of the initialization process.\nThe risk implications involve operational disruption of infrastructure deployments and dependency management pipelines.\nAttackers require the capability to supply or influence the .zip archive served as a provider or module package during the tofu init execution.",
  "technicalDetails": "The vulnerability resides within the package handling logic of the tofu init command, specifically in the routine responsible for processing and extracting .zip archives utilized for provider and module packages.\nThe root cause stems from inefficient handling or parsing of maliciously-crafted .zip archive structures, leading to algorithmic complexity issues or excessive resource consumption during archive traversal and decompression.\nAffected versions include all OpenTofu releases prior to version 1.11.4.\nThe attack flow begins when a user or automated pipeline executes the tofu init command against a malicious or compromised source, such as a rogue registry, malicious module source, or manipulated local path.\nDuring dependency installation, the vulnerable component downloads or accesses the maliciously-crafted .zip archive.\nUpon attempting to process the archive, the parsing logic enters a state of excessive CPU utilization due to the crafted structure of the file.\nThis intensive CPU consumption exhausts system resources, leading to degraded performance and a complete blockage of the tofu init process from completing successfully.\nNo specific authentication or elevated privilege requirements are explicitly mandated for the target system executing the command, provided the user or process invokes the initialization against the untrusted package source.\nThe post-exploitation impact is limited to denial of service through resource exhaustion, preventing infrastructure configuration and deployment workflows."
}