CVE-2026-74797lowCWE-400

CVE-2026-74797: low-severity vulnerability in opentofu

OpenTofu before 1.11.4 Denial of Service via malicious zip

Published · Updated

Follow this CVE+ Monitor opentofu+ Monitor github.com/opentofu/opentofu

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.3epss 0.3%
OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
opentofu · opentofu
Related CVEs — opentofu

In the same product, most dangerous first.

CVE-2024-58375HIGHOpenTofu before 1.8.3 Secret Variable Leaking via Static EvaluationEPSS 0.4%CVE-2026-74796HIGHOpenTofu before 1.11.7 Symlink Following Path TraversalEPSS 0.3%