OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses

Impact Unauthenticated denial of service. Summary When installing module packages from attacker-controlled sources, tofu init may use unbounded memory, cause high CPU usage, or deadlock when encountering maliciously-crafted TLS certificate chains or tar archives. Those who depend on modules or...

CVE-2026-41064

creationtimestamp| type| source ---|---|--- 2026-04-14 23:27:18+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-pq8p-wc4f-vg7j 2026-04-22 00:00:41+00:00| seen| https://infosec.exchange/users/offseq/statuses/116445415944468240 2026-04-22 00:00:42+00:00| seen|...

CVE-2026-34619

creationtimestamp| type| source ---|---|--- 2026-04-14 23:22:03+00:00| seen| Telegram/7o25spvsi10qoVsYDQCR4BvQZf2Pb0MXjY1dtOy-qDOy7tc 2026-04-15 12:00:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjjtuloymz2w 2026-04-15 13:55:20+00:00| seen|...

CVE-2026-27305

creationtimestamp| type| source ---|---|--- 2026-04-14 23:21:52+00:00| seen| Telegram/jHpVmdM968c9lFQ4KStSRALTqvtLmQ8NC1zLLnKyLbbys0E 2026-04-15 13:19:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjjycrdx3s2a 2026-04-15 13:55:19+00:00| seen|...

CVE-2026-33018

creationtimestamp| type| source ---|---|--- 2026-04-14 23:21:52+00:00| seen| Telegram/jHpVmdM968c9lFQ4KStSRALTqvtLmQ8NC1zLLnKyLbbys0E 2026-04-14 23:22:03+00:00| seen| Telegram/7o25spvsi10qoVsYDQCR4BvQZf2Pb0MXjY1dtOy-qDOy7tc...

CVE-2026-34618

creationtimestamp| type| source ---|---|--- 2026-04-14 20:19:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mji7c54dgc24 2026-04-14 20:31:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mji7yq5j4f2o 2026-04-14 21:25:42+00:00| published-proof-of-concept|...

CVE-2026-27303

creationtimestamp| type| source ---|---|--- 2026-04-14 20:07:55+00:00| seen| Telegram/b-0H5pCtilxNZxS-gRRPsAWUA3zqxMoGzwWTkVBCMIvH7s 2026-04-15 06:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116407194668187884 2026-04-15 06:00:31+00:00| seen|...

CVE-2026-27245

creationtimestamp| type| source ---|---|--- 2026-04-14 20:07:48+00:00| seen| Telegram/vjfxnNTg64imjnjxPGtl8BfvNjTDmt0KKDhXRC5WEaV7Sg 2026-04-15 09:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116407902478004814 2026-04-15 09:00:32+00:00| seen|...

CVE-2026-38529

creationtimestamp| type| source ---|---|--- 2026-04-14 16:47:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjhtgkwkrb2s 2026-04-14 16:53:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhtrvd3vn2k 2026-04-23 20:37:07+00:00| seen|...

CVE-2026-38527

creationtimestamp| type| source ---|---|--- 2026-04-14 16:46:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjhtgdu6nh2u 2026-04-14 17:07:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhulnqatj2z...

CVE-2025-63939

creationtimestamp| type| source ---|---|--- 2026-04-14 16:45:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhtebmbxy2k 2026-04-14 16:53:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjhtsyye6b25...

CVE-2025-65135

creationtimestamp| type| source ---|---|--- 2026-04-14 16:43:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhtagncml2g 2026-04-14 16:51:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjhtosxxmr2s...

CVE-2026-39813

creationtimestamp| type| source ---|---|--- 2026-04-14 16:34:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjhspwbtnj2m 2026-04-14 17:12:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhuum6ow52o 2026-04-14 17:28:30+00:00| seen|...

CVE-2026-32198

creationtimestamp| type| source ---|---|--- 2026-04-14 12:20:56+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0116 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 19:38:44+00:00| seen|...

CVE-2026-32203

creationtimestamp| type| source ---|---|--- 2026-04-14 12:18:58+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0114 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 19:38:27+00:00| seen|...

CVE-2026-22692

creationtimestamp| type| source ---|---|--- 2026-04-14 06:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/80224 2026-04-14 07:00:13+00:00| published-proof-of-concept| Telegram/jkyf9FzBP6ABW034R3vx4BiSgaWbMQXv6i-pn331gsPUnTk 2026-04-14 15:00:07+00:00| published-proof-of-concept...

CVE-2026-24032

creationtimestamp| type| source ---|---|--- 2026-04-14 03:04:52+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-per-prodotti-siemens-20 2026-04-14 10:15:28+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mjh5khsmve2l 2026-04-14 11:16:55+00:00| seen|...

CVE-2026-6264

creationtimestamp| type| source ---|---|--- 2026-04-14 03:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116400824547176921 2026-04-14 03:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjgfaosg362i 2026-04-14 04:00:49+00:00| seen|...

CVE-2026-39958

oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...

PT-2026-34560

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.31.1 Description Kiota is an OpenAPI based HTTP Client code generator. A code-generation literal injection exists in multiple writer sinks, including serialization/deserialization keys, path/query parameter mappings,...