CVE-2026-74797 OpenTofu before 1.11.4 Denial of Service via malicious zip
Attackers can cause excessive CPU usage and system degradation in OpenTofu by serving malicious zip archives during dependency installation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-74797?
CVE-2026-74797 is a low-severity denial of service vulnerability in opentofu, published on 16 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process.
Weakness: CWE-400
Which versions are affected by CVE-2026-74797?
3 open source packages ship an affected version, including github.com/opentofu/opentofu.
| Package | Affected | Fixed in |
|---|---|---|
github.com/opentofu/opentofu Go | All versions | 1.11.4 |
github.com/opentofu/opentofu Go | All versions | 1.11.4 |
github.com/opentofu/opentofu Go | All versions | 1.11.4 |
How do I fix CVE-2026-74797?
Upgrade github.com/opentofu/opentofu to 1.11.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74797 being exploited?
There is no known exploitation of CVE-2026-74797 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-MI15449, CLEANSTART-2026-SO98691, GHSA-3vh9-9frp-jhqv, GHSA-r92c-9c7f-3pj8, GO-2026-4352, MINI-mv5w-gjh7-wx55 and 1 more.