CLEANSTART-2026-AZ32516 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-ZD89666 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-JX46109 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-YG94604 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-QZ70444 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-AZ24638 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-CK35256 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

GHSA-R92C-9C7F-3PJ8 vulnerabilities

Vulnerabilities for packages: opentofu...

GHSA-R92C-9C7F-3PJ8 vulnerabilities

Vulnerabilities for packages: opentofu...

OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format

Impact Unauthenticated denial of service. Summary When installing module packages from attacker-controlled sources, tofu init may cause high CPU usage when encountering maliciously-crafted .zip archives for either provider or module distribution packages. Those who depend on modules or providers...

PT-2026-73164

Name of the Vulnerable Software and Affected Versions OpenTofu versions prior to 1.11.4 Description A denial of service issue exists in the tofu init command when processing maliciously-crafted .zip archives used for provider or module packages. An attacker can control the content of the .zip...

GHSA-W2JF-268Q-MRVH vulnerabilities

Vulnerabilities for packages: opentofu...

GHSA-W2JF-268Q-MRVH vulnerabilities

Vulnerabilities for packages: opentofu...

[SECURITY] Fedora 43 Update: opentofu-1.11.2-1.fc43

OpenTofu lets you declaratively manage your cloud infrastructure...

Fedora: Security Advisory (FEDORA-2025-6968ab200a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 43 : opentofu (2025-6968ab200a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6968ab200a advisory. Update to 1.11.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

GO-2025-4224 OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs in github.com/opentofu/opentofu

OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs in github.com/opentofu/opentofu...

GHSA-MJCP-GPGX-GGCG OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs

When OpenTofu is acting as a TLS client authenticating a certificate chain provided by a TLS server, an excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com...

EUVD-2025-202334

OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs...

GO-2025-4101 OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses in github.com/opentofu/opentofu

OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses in github.com/opentofu/opentofu...