CVE-2026-74797 in OpenTofu
Summary
by MITRE • 08/16/2026
OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
OpenTofu versions prior to 1.11.4 are susceptible to a denial of service vulnerability within the tofu init command execution path. This specific flaw arises when the tool processes maliciously crafted zip archives intended for provider or module packages during the dependency installation phase. The core technical issue lies in how the application handles the extraction and parsing of these archive contents, allowing an attacker who controls the content served from a remote repository to trigger excessive resource consumption on the target system.
The operational impact of this vulnerability is significant as it leads to sustained high CPU usage that can degrade overall system performance. By exploiting this flaw, an adversary can effectively stall or prevent the timely completion of the init process, which is critical for initializing infrastructure code and resolving dependencies. This disruption hinders development workflows and deployment pipelines, potentially causing delays in software delivery and reducing the availability of the OpenTofu tooling environment for legitimate users.
From a classification perspective, this vulnerability aligns with CWE-400, Uncontrolled Resource Consumption, as it involves an attacker inducing excessive resource usage through crafted input data. It also maps to MITRE ATT&CK technique T1496, Resource Hijacking, where the primary goal is not necessarily data theft but rather the degradation of service availability by consuming computational resources such as CPU cycles and memory during the archive processing routine.
Mitigation strategies primarily involve upgrading OpenTofu to version 1.11.4 or later, which addresses the underlying parsing logic flaws that allow for this resource exhaustion attack vector. In environments where immediate patching is not feasible, organizations should implement strict validation of provider and module sources, ensuring that only trusted repositories are used during dependency resolution. Additionally, applying rate limiting or timeout mechanisms to the init command can help mitigate the impact by preventing indefinite processing loops caused by malicious archive structures.