https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:40:26 +0000 https://db.gcve.eu/vuln/ghsa-r92c-9c7f-3pj8 <p><strong>Affected:</strong> Go: github.com/opentofu/opentofu</p> <p>### Impact Unauthenticated denial of service.</p> <p>### Summary When installing module packages from attacker-controlled sources, `tofu init` may cause high CPU usage when encountering maliciously-crafted `.zip` archives for either provider or module distribution packages.</p> <p>Those who depend on modules or providers served from untrusted third-party servers may experience denial of service due to `tofu init` failing to complete in a timely manner. Other processes running on the same computer as OpenTofu may also have their performance degraded due to the high CPU usage.</p> <p>These vulnerabilities **do not** permit arbitrary code execution or allow disclosure of confidential information.</p> <p>### Details</p> <p>OpenTofu relies on a third-party implementation of `.zip` archive extraction from the standard library of the Go programming language. The Go project has recently published a minor release (Go 1.25.6) to address a problem of potential excessive CPU usage when accessing files in a maliciously-crafted `.zip` archive.</p> <p>OpenTofu&#39;s threat model considers module and package dependencies to be arbitrary third-party code that operators must carefully review after installation. However, this particular problem affects the process of installing these dependencies with `tofu init`, and so can potentially occur before an operator has had the opportunity to review what is being installed.</p> <p>An attacker can exploit this by controlling the content of a package served when OpenTofu is expecting to receive…</p> <p><strong>Affected:</strong> Go: github.com/opentofu/opentofu</p> <p>### Impact Unauthenticated denial of service.</p> <p>### Summary When installing module packages from attacker-controlled sources, `tofu init` may cause high CPU usage when encountering maliciously-crafted `.zip` archives for either provider or module distribution packages.</p> <p>Those who depend on modules or providers served from untrusted third-party servers may experience denial of service due to `tofu init` failing to complete in a timely manner. Other processes running on the same computer as OpenTofu may also have their performance degraded due to the high CPU usage.</p> <p>These vulnerabilities **do not** permit arbitrary code execution or allow disclosure of confidential information.</p> <p>### Details</p> <p>OpenTofu relies on a third-party implementation of `.zip` archive extraction from the standard library of the Go programming language. The Go project has recently published a minor release (Go 1.25.6) to address a problem of potential excessive CPU usage when accessing files in a maliciously-crafted `.zip` archive.</p> <p>OpenTofu&#39;s threat model considers module and package dependencies to be arbitrary third-party code that operators must carefully review after installation. However, this particular problem affects the process of installing these dependencies with `tofu init`, and so can potentially occur before an operator has had the opportunity to review what is being installed.</p> <p>An attacker can exploit this by controlling the content of a package served when OpenTofu is expecting to receive…</p> https://db.gcve.eu/vuln/ghsa-r92c-9c7f-3pj8