---
id: CVE-2026-74797
title: >-
  OpenTofu versions before 1.11.4 contain a denial of service vulnerability in
  the tofu init command when processing maliciously-crafted .zip archives for
  provider or module packages
summary: >-
  OpenTofu versions before 1.11.4 contain a denial of service vulnerability in
  the tofu init command when processing maliciously-crafted .zip archives for
  provider or module packages. Attackers can cause excessive CPU usage by
  controlling …
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L'
cwe:
  - CWE-400
vendor: opentofu
product: github.com/opentofu/opentofu
affected:
  - github.com/opentofu/opentofu < 1.11.4
patched:
  - github.com/opentofu/opentofu 1.11.4
published: '2026-08-16'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:28:37.587'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74797'
references:
  - url: >-
      https://github.com/opentofu/opentofu/security/advisories/GHSA-r92c-9c7f-3pj8
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/opentofu-before-denial-of-service-via-malicious-zip
    label: disclosure@vulncheck.com
  - url: 'https://github.com/golang/go/issues/77102'
  - url: 'https://github.com/opentofu/opentofu/pull/3689'
  - url: >-
      https://github.com/opentofu/opentofu/commit/f5d5cdf16615ea3c298e058b062951adb02805f3
  - url: 'https://github.com/opentofu/opentofu'
  - url: 'https://github.com/opentofu/opentofu/releases/tag/v1.11.4'
tags:
  - nvd
  - osv
  - go
epss: 0.00174
epssPercentile: 0.07188
aliases:
  - GHSA-r92c-9c7f-3pj8
  - GO-2026-4352
ecosystem: go
ingestedAt: '2026-08-17T19:20:55.933Z'
---

## Overview

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-74797)

Affected packages:

- `github.com/opentofu/opentofu < 1.11.4`

Patched in:

- `github.com/opentofu/opentofu 1.11.4`

Source: https://osv.dev/vulnerability/GHSA-r92c-9c7f-3pj8