OS & platform
Low
OpenTofu may accidentally expose sensitive variables in module sources and backend configurations when static evaluation is enabled, even though this should be blocked.
Advisory
07.06.2026
OS & platform
OpenTofu
Linux Foundation
v1.12.1
bewährt
latest release
27.05.2026
27.05.2026
Upgrade assessment
UnkritischUpgrade unkritisch
7 CVE(s) zuletzt (niedrige/mittlere Schwere)
Derived automatically from release, repo and CVE data — no judgment by a language model.
Specsattributes
gh_etagW/"2f6669a4ffa15b8bbe6e221f16f4059016b98f1628bc0ec557de7bf8fdd2e89f"
eol_productopentofu
gh_checked_at2026-06-08T00:45:00.096648+00:00
Timelinealle Einträge
Type
Ereignis · Quelle
Value · Time
OS & platform
Low
OpenTofu, an infrastructure-as-code tool, is vulnerable to denial-of-service attacks during module installation when maliciously crafted TLS certificates or archives from untrusted sources are used, potentially causing high CPU usage or memory consumption.
Advisory
07.06.2026
OS & platform
Medium
OpenTofu incorrectly validates TLS certificates when excluded subdomains and wildcard certificates are combined, allowing attackers with valid but contradictory certificates to potentially establish connections to protected servers.
Advisory
07.06.2026
OS & platform
Low
OpenTofu, an infrastructure-as-code tool, is vulnerable to denial-of-service attacks through maliciously crafted ZIP archives when installing modules or providers, causing high CPU usage.
Advisory
07.06.2026
OS & platform
Low
OpenTofu can be crashed when installing modules from untrusted sources through malicious TLS certificates or tar archives, causing unbounded memory usage or high CPU load.
Advisory
07.06.2026
OS & platform
Medium
OpenTofu follows symbolic links in the .terraform/providers directory during provider installation and can write files to arbitrary directories when an attacker controls the working directory.
Advisory
07.06.2026
OS & platform
Low
OpenTofu can enter an infinite loop when installing modules or providers from malicious servers, causing the installation process to hang and depleting system resources.
Advisory
07.06.2026
v1.12.1
27.05.2026
v1.11.8
14.05.2026
v1.12.0
14.05.2026
v1.10.10
11.05.2026
v1.11.7
11.05.2026
v1.12.0-rc1
29.04.2026
v1.11.6
08.04.2026
v1.12.0-beta1
08.04.2026
v1.10.9
12.02.2026
v1.11.5
12.02.2026
v1.11.4
21.01.2026
v1.11.3
13.01.2026
v1.11.2
19.12.2025
v1.11.1
10.12.2025
1.11
09.12.2025
v1.11.0
09.12.2025
v1.10.8
08.12.2025
v1.11.0-rc4
25.11.2025
v1.11.0-rc3
19.11.2025
v1.11.0-rc2
17.11.2025
v1.10.7
06.11.2025
v1.11.0-rc1
03.11.2025
v1.11.0-beta1
23.10.2025
v1.9.4
03.09.2025
v1.10.6
03.09.2025
v1.10.5
01.08.2025
v1.7.10
31.07.2025
v1.8.11
31.07.2025
v1.9.3
31.07.2025
v1.10.4
31.07.2025
v1.10.3
15.07.2025
1.10
24.06.2025
1.9
09.01.2025
1.8
29.07.2024
1.7
30.04.2024
1.6
09.01.2024