Go/github.com/opentofu/opentofu: low 3.1
OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses
Action: Upgrade github.com/opentofu/opentofu to 1.10.7 or later.
go get github.com/opentofu/opentofu@v1.10.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.10.7 | - |
Fixed versions
| 1.10.7 |
Sources
- osv: GHSA-w2jf-268q-mrvh
- https://github.com/opentofu/opentofu/security/advisories/GHSA-w2jf-268q-mrvh
- https://github.com/opentofu/opentofu/issues/3458
- https://github.com/opentofu/opentofu/issues/3462
- https://github.com/opentofu/opentofu/issues/3464
- https://github.com/opentofu/opentofu/issues/3465
- https://github.com/opentofu/opentofu/pull/3467
- https://github.com/opentofu/opentofu
- https://github.com/opentofu/opentofu/releases/tag/v1.10.7
- https://www.cve.org/CVERecord?id=CVE-2025-58183
- https://www.cve.org/CVERecord?id=CVE-2025-58185
- https://www.cve.org/CVERecord?id=CVE-2025-58187
- https://www.cve.org/CVERecord?id=CVE-2025-58188
published · modified · JSON