CyberRota Analysis
AI-GeneratedOpenTofu versions prior to 1.11.4 are susceptible to a denial of service vulnerability that arises when the tofu init command processes specially crafted .zip archives for provider or module packages. This flaw allows attackers to manipulate the content of .zip archives, leading to excessive CPU consumption and hindering system performance during dependency installation. Organizations utilizing OpenTofu should prioritize updating to version 1.11.4 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process.