Go/github.com/opentofu/opentofu: unknown
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers in github.com/opentofu/opentofu
Action: Upgrade github.com/opentofu/opentofu to 1.11.9 or later.
go get github.com/opentofu/opentofu@v1.11.9go get github.com/opentofu/opentofu@v1.12.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.11.9 | - |
| 1.12.0-beta1 | 1.12.2 | - |
Fixed versions
| 1.11.9 | 1.12.2 |
Sources
- osv: GO-2026-6262
- https://github.com/opentofu/opentofu/security/advisories/GHSA-22w5-2fxg-vrwx
- https://github.com/opentofu/opentofu/issues/4242
- https://github.com/opentofu/opentofu/issues/4243
- https://github.com/opentofu/opentofu/issues/4244
- https://github.com/opentofu/opentofu/releases/tag/v1.11.9
- https://github.com/opentofu/opentofu/releases/tag/v1.12.2
published · modified · JSON