GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: chisel, upwind-agent, knative-serving, flux, zot, frankenphp-8.2, flux-image-automation-controller, istio, frankenphp-8.4, opentofu-fips, minio-fips, coder, flux-source-controller, loki, harbor-fips, kube-arangodb-fips, knative-serving-fips, k3s, kyverno-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: chisel, upwind-agent, knative-serving, flux, zot, frankenphp-8.2, flux-image-automation-controller, istio, frankenphp-8.4, opentofu-fips, minio-fips, coder, flux-source-controller, loki, harbor-fips, kube-arangodb-fips, knative-serving-fips, k3s, kyverno-fips,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: upwind-agent, knative-serving, flux, zot, external-secrets-operator, frankenphp-8.2, flux-image-automation-controller, istio, pulumi-language-java, frankenphp-8.4, opentofu-fips, amazon-ssm-agent-fips, minio-fips, cg, flux-source-controller, prometheus-podman-exporte...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: upwind-agent, knative-serving, flux, zot, frankenphp-8.2, istio, frankenphp-8.4, opentofu-fips, loki, harbor-fips, kube-arangodb-fips, knative-serving-fips, k3s, kyverno-fips, traefik-fips, argo-cd-fips, teleport-operator-fips, zitadel, rancher-agent, terraform,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: chisel, upwind-agent, knative-serving, crossplane-provider-azure-authorization, flux, crossplane-provider-azure-streamanalytics, external-secrets-operator, frankenphp-8.2, tflint, flux-image-automation-controller, flux-operator-fips, hcloud, istio,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, cilium-cli, steampipe, external-secrets-operator, syft, nuclei, spire-server, kyverno, nerdctl, mattermost, opentofu, policy-controller, pulumi-language-java, grype, tkn, flux-source-controller, trivy-operator, step-kms-plugin, zarf,...

GO-2026-5705 OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu...

GO-2026-5571 OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu

OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu...

GO-2026-5558 OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opentofu

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opentofu...

GO-2026-5441 OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/opentofu/opentofu

OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/opentofu/opentofu...

GHSA-Q7J3-V8QV-22VQ OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL

Impact Possible data exposure. Summary While downloading packages from a maliciously crafted URL, some git operations against that URL could allow arbitrary file read. This might allow disclosure of confidential information. Details OpenTofu relies on go-getter for downloading packages like...

GHSA-PXH5-6RRC-8RJV vulnerabilities

Vulnerabilities for packages: opentofu...

GHSA-PXH5-6RRC-8RJV vulnerabilities

Vulnerabilities for packages: opentofu-fips, opentofu...

GHSA-PXH5-6RRC-8RJV OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

Impact Unauthenticated denial of service. Summary When installing provider or module packages from attacker-controlled servers, the server may cause tofu initto enter an infinite loop sending garbage data to that server. Those who depend on modules or providers served from untrusted third-party...

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

Impact Unauthenticated denial of service. Summary When installing provider or module packages from attacker-controlled servers, the server may cause tofu initto enter an infinite loop sending garbage data to that server. Those who depend on modules or providers served from untrusted third-party...

CLEANSTART-2026-CN84623 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-GY48351 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-XN15507 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Multiple security vulnerabilities affect the opentofu-fips package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...

CLEANSTART-2026-MI12470 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-SO13464 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Multiple security vulnerabilities affect the opentofu-fips package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...