GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: redpanda-console, prometheus-operator, kube-conformance, kubescape-server, gitlab-workhorse-ce-fips, terragrunt, frankenphp-8.3, prometheus-mongodb-exporter, elastic-agent-fips, external-secrets-operator, splunk-otel-collector, keda-fips, terraform, grype-fips, helm,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: prometheus-operator, docker-cli-buildx-fips, kube-conformance, gitlab-workhorse-ce-fips, frankenphp-8.3, prometheus-mongodb-exporter, elastic-agent-fips, external-secrets-operator, keda-fips, terraform, helm, vault, kubernetes, packer, zot, kine, flux, cilium-cli,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: cluster-api-azure-controller, flux-notification-controller, prometheus-operator, buildah, dagger, zot, gomplate, gitea, podman, argo-events, buildkitd, datadog-agent, melange, apko, eksctl, pulumi-language-dotnet, ksops, wolfictl, flux, osv-scanner,...

GO-2026-5705 OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu...

GO-2026-5571 OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu

OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu...

GO-2026-5558 OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opentofu

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opentofu...

GO-2026-5441 OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/opentofu/opentofu

OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/opentofu/opentofu...

GHSA-Q7J3-V8QV-22VQ OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL

Impact Possible data exposure. Summary While downloading packages from a maliciously crafted URL, some git operations against that URL could allow arbitrary file read. This might allow disclosure of confidential information. Details OpenTofu relies on go-getter for downloading packages like...

GHSA-PXH5-6RRC-8RJV vulnerabilities

Vulnerabilities for packages: opentofu...

GHSA-PXH5-6RRC-8RJV vulnerabilities

Vulnerabilities for packages: opentofu-fips, opentofu...

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

Impact Unauthenticated denial of service. Summary When installing provider or module packages from attacker-controlled servers, the server may cause tofu initto enter an infinite loop sending garbage data to that server. Those who depend on modules or providers served from untrusted third-party...

GHSA-PXH5-6RRC-8RJV OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

Impact Unauthenticated denial of service. Summary When installing provider or module packages from attacker-controlled servers, the server may cause tofu initto enter an infinite loop sending garbage data to that server. Those who depend on modules or providers served from untrusted third-party...

CLEANSTART-2026-CN84623 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-GY48351 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-XN15507 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Multiple security vulnerabilities affect the opentofu-fips package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...

CLEANSTART-2026-MI12470 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-SO13464 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Multiple security vulnerabilities affect the opentofu-fips package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: telegraf, zot, gitea, grafana, seaweedfs, trufflehog, dex, terraform, teleport, cert-manager-csi-driver, bento, openbao, nuclei, rclone, minio, percona-server-mongodb-operator, spqr, cert-manager-cmctl, kyverno-notation-aws, rancher, yunikorn-k8shim, ratify, xeol,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: telegraf, zot, gitea, grafana, seaweedfs, trufflehog, dex, terraform, teleport, cert-manager-csi-driver, bento, openbao, nuclei, rclone, minio, percona-server-mongodb-operator, spqr, cert-manager-cmctl, kyverno-notation-aws, rancher, yunikorn-k8shim, ratify, xeol,...

OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses

Impact Unauthenticated denial of service. Summary When installing module packages from attacker-controlled sources, tofu init may use unbounded memory, cause high CPU usage, or deadlock when encountering maliciously-crafted TLS certificate chains or tar archives. Those who depend on modules or...