CVE-2026-74797 opentofu CVE debrief

Who should care

Defenders responsible for OpenTofu deployments, including operators, platform administrators, vulnerability management teams, and security teams, should assess exposure and prioritize verification of OpenTofu versions and restriction of access to .zip archives. They should also monitor system performance and CPU usage during the init process and plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

Defenders should care about CVE-2026-74797 because it affects OpenTofu versions before 1.11.4, allowing attackers to cause excessive CPU usage and degrade system performance. Defenders responsible for OpenTofu deployments should assess exposure, prioritize verification of OpenTofu versions, and restrict access to .zip archives to prevent potential denial of service attacks. The corpus lacks specific information on affected versions, exploitation, and remediation, requiring verification from official sources.

• Potential degradation of system performance
• Prevention of timely completion of the init process
• Need for verification of OpenTofu versions and remediation

Technical summary

The OpenTofu init command is vulnerable to a denial of service attack when processing maliciously-crafted .zip archives. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, potentially degrading system performance and preventing timely completion of the init process. This vulnerability affects OpenTofu versions before 1.11.4. Defenders should prioritize verifying OpenTofu versions and restricting access to .zip archives to prevent potential denial of service attacks.

Defensive priority

Defenders should prioritize verifying OpenTofu versions and restricting access to .zip archives to prevent potential denial of service attacks.

Recommended defensive actions

• Verify OpenTofu version and upgrade to 1.11.4 or later
• Restrict access to .zip archives served during dependency installation
• Monitor system performance and CPU usage during init process
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, specific information on affected versions, exploitation, and remediation is limited in the corpus. Defenders should verify OpenTofu versions, assess exposure, and restrict access to .zip archives. The corpus lacks explicit evidence of vendor guidance, affected scope, or remediation steps. Therefore, defenders must consult official sources for further details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.