206 matches found
CLEANSTART-2026-AZ24638 Within HostnameError
Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...
CLEANSTART-2026-CK35256 Within HostnameError
Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...
GHSA-R92C-9C7F-3PJ8 vulnerabilities
Vulnerabilities for packages: opentofu...
GHSA-R92C-9C7F-3PJ8 vulnerabilities
Vulnerabilities for packages: opentofu...
OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format
Impact Unauthenticated denial of service. Summary When installing module packages from attacker-controlled sources, tofu init may cause high CPU usage when encountering maliciously-crafted .zip archives for either provider or module distribution packages. Those who depend on modules or providers...
PT-2026-73164
Name of the Vulnerable Software and Affected Versions OpenTofu versions prior to 1.11.4 Description A denial of service issue exists in the tofu init command when processing maliciously-crafted .zip archives used for provider or module packages. An attacker can control the content of the .zip...
GHSA-W2JF-268Q-MRVH vulnerabilities
Vulnerabilities for packages: opentofu...
GHSA-W2JF-268Q-MRVH vulnerabilities
Vulnerabilities for packages: opentofu...
[SECURITY] Fedora 43 Update: opentofu-1.11.2-1.fc43
OpenTofu lets you declaratively manage your cloud infrastructure...
Fedora: Security Advisory (FEDORA-2025-6968ab200a)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora 43 : opentofu (2025-6968ab200a)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6968ab200a advisory. Update to 1.11.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...
GO-2025-4224 OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs in github.com/opentofu/opentofu
OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs in github.com/opentofu/opentofu...
PT-2025-54733
OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs in github.com/opentofu/opentofu...
GHSA-MJCP-GPGX-GGCG OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs
When OpenTofu is acting as a TLS client authenticating a certificate chain provided by a TLS server, an excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com...
EUVD-2025-202334
OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs...
GO-2025-4101 OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses in github.com/opentofu/opentofu
OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses in github.com/opentofu/opentofu...
Fedora: Security Advisory (FEDORA-2025-21b93506d5)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 41 Update: opentofu-1.10.7-1.fc41
OpenTofu lets you declaratively manage your cloud infrastructure...