CLEANSTART-2026-QW04025 Security fixes in opentofu-fips 1.11.5-r3

Package opentofu-fips version 1.11.5-r3 fixes 16 vulnerabilities: ghsa-78h2-9frx-2jm8, CVE-2026-34986, ghsa-hfvc-g4fc-pqhx, CVE-2026-39883, ghsa-w8rr-5gcm-pp58...

CLEANSTART-2026-QF23668 Security fixes in opentofu-fips 1.11.5-r0

Package opentofu-fips version 1.11.5-r0 fixes 2 vulnerabilities: CVE-2026-1229, CVE-2026-24051...

CLEANSTART-2026-FG71338 Security fixes in opentofu-fips 1.8.11-r5

Package opentofu-fips version 1.8.11-r5 fixes 9 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...

CLEANSTART-2026-RZ67002 Security fixes in opentofu-fips 1.10.9-r2

Package opentofu-fips version 1.10.9-r2 fixes 3 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentofu1.12: opentofu1.12-1.12.5-0.2.hum1 aarch64, x8664 opentofu1.12-1.12.5-0.2.hum1.src src Security Fixes: opentofu1.12: CVE-2026-56852...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentofu1.10: opentofu1.10-1.10.10-0.3.hum1 aarch64, x8664 opentofu1.10-1.10.10-0.3.hum1.src src Security Fixes: opentofu1.10: CVE-2026-56852...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, frankenphp-8.3, flux, terraform, prometheus-mongodb-exporter, frankenphp-8.2, trivy-fips, flux-source-controller, kyverno-fips, k3s, external-secrets-operator, tekton-pipelines, etcd-fips, spire-server, tekton-pipelines-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-solutions, crossplane-provider-azure-sql, knative-kafka-broker-fips, terraform-provider-azurerm-fips, frankenphp-8.3, flux, helmfile, kyverno-policy-reporter-plugins-kyverno, nfpm, neuvector-sigstore-interface-fips, terraform,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, frankenphp-8.3, flux, terraform, prometheus-mongodb-exporter, frankenphp-8.2, trivy-fips, flux-source-controller, kyverno-fips, k3s, external-secrets-operator, tekton-pipelines, etcd-fips, spire-server, tekton-pipelines-fips,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, frankenphp-8.3, flux, nfpm, terraform, prometheus-mongodb-exporter, guac, frankenphp-8.2, trivy-fips, flux-source-controller, kyverno-fips, k3s, external-secrets-operator, terragrunt, tekton-pipelines, mapotf, etcd-fips, spire-server,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, frankenphp-8.3, flux, terraform, prometheus-mongodb-exporter, frankenphp-8.2, kyverno-fips, k3s, external-secrets-operator, tekton-pipelines, etcd-fips, spire-server, tekton-pipelines-fips, cloud-provider-aws, teleport-operator-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: tkn, mods, containerd, external-secrets-operator, step, podman, eksctl, spire-server, flux, skaffold, flux-source-controller, kubernetes, chisel, dagger, trivy, istio, crossplane-provider-azure-storage, tekton-chains, ksops, flux-notification-controller, mattermost,...

GO-2026-5705 OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu...

GO-2026-5571 OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu

OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu...

GO-2026-5558 OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opentofu

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opentofu...

GO-2026-5441 OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/opentofu/opentofu

OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/opentofu/opentofu...

GHSA-Q7J3-V8QV-22VQ OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL

Impact Possible data exposure. Summary While downloading packages from a maliciously crafted URL, some git operations against that URL could allow arbitrary file read. This might allow disclosure of confidential information. Details OpenTofu relies on go-getter for downloading packages like...

GHSA-PXH5-6RRC-8RJV vulnerabilities

Vulnerabilities for packages: opentofu...

GHSA-PXH5-6RRC-8RJV vulnerabilities

Vulnerabilities for packages: opentofu-fips, opentofu...

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

Impact Unauthenticated denial of service. Summary When installing provider or module packages from attacker-controlled servers, the server may cause tofu initto enter an infinite loop sending garbage data to that server. Those who depend on modules or providers served from untrusted third-party...