github.com/opentofu/opentofu vulnerabilities
CVEs whose affected-version data names the github.com/opentofu/opentofu package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
GO-2026-6262NoneOpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or c…
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers in github.com/opentofu/opentofu
GHSA-22w5-2fxg-vrwxLow· 2.6OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or c…
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers
GHSA-wcmj-x466-56mmMedium· 6.1OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree
OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree
GHSA-q7j3-v8qv-22vqHigh· 7.5OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL
OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL