Affected: Go: github.com/opentofu/opentofu

### Impact Unauthenticated denial of service.

### Summary When installing module packages from attacker-controlled sources, `tofu init` may cause high CPU usage when encountering maliciously-crafted `.zip` archives for either provider or module distribution packages.

Those who depend on modules or providers served from untrusted third-party servers may experience denial of service due to `tofu init` failing to complete in a timely manner. Other processes running on the same computer as OpenTofu may also have their performance degraded due to the high CPU usage.

These vulnerabilities **do not** permit arbitrary code execution or allow disclosure of confidential information.

### Details

OpenTofu relies on a third-party implementation of `.zip` archive extraction from the standard library of the Go programming language. The Go project has recently published a minor release (Go 1.25.6) to address a problem of potential excessive CPU usage when accessing files in a maliciously-crafted `.zip` archive.

OpenTofu's threat model considers module and package dependencies to be arbitrary third-party code that operators must carefully review after installation. However, this particular problem affects the process of installing these dependencies with `tofu init`, and so can potentially occur before an operator has had the opportunity to review what is being installed.

An attacker can exploit this by controlling the content of a package served when OpenTofu is expecting to receive…