CVE-2026-74797

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-74797
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74797.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-74797
Aliases
Published
2026-08-16T13:14:19.060Z
Modified
2026-08-17T03:55:57.844476117Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenTofu before 1.11.4 Denial of Service via malicious zip
Details

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process.

Database specific 
{
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74797.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/opentofu/opentofu

Affected ranges

Type
GIT
Repo
https://github.com/opentofu/opentofu
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2a9b7ac61409f7f22bde65c192c5814eb4b75cdf
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.11.4"
        }
    ]
}

Affected versions

v1.*
v1.10.0-alpha1
v1.10.0-alpha2
v1.10.0-beta1
v1.11.0
v1.11.0-beta1
v1.11.0-rc1
v1.11.0-rc2
v1.11.0-rc3
v1.11.0-rc4
v1.11.1
v1.11.2
v1.11.3
v1.6.0-alpha1
v1.6.0-alpha3
v1.6.0-alpha4
v1.6.0-alpha5
v1.6.0-beta1
v1.6.0-beta2
v1.6.0-beta3
v1.6.0-beta4
v1.6.0-beta5
v1.6.0-rc1
v1.7.0-alpha1
v1.7.0-beta1
v1.8.0-alpha1
v1.8.0-beta1
v1.8.0-beta2
v1.9.0-alpha1
v1.9.0-alpha2
v1.9.0-beta1
v1.9.0-beta2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74797.json"