GHSA-hw5x-4r37-72w7

The record

When installing module packages from attacker-controlled sources, `tofu init` may use unbounded memory, cause high CPU usage, or deadlock when encountering maliciously-crafted TLS certificate chains or tar archives. Those who depend on modules or providers served from untrusted third-party servers may experience denial of service due to `tofu init` failing to complete successfully. In the case of unbounded memory usage or high CPU usage, other processes running on the same computer as OpenTofu may also fail or have their performance degraded due to the depletion of shared system resources. These vulnerabilities **do not** permit arbitrary code execution or allow disclosure of confidential information.

Affected packages

Related vulnerabilities

• GHSA-39h7-pwv7-rc3x Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) CWE-1395
• GHSA-3hfp-gqgh-xc5g Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios… CWE-1395
• GHSA-658g-p7jg-wx5g Axios npm Supply Chain Incident Impacting @usebruno/cli CWE-1395
• GHSA-w2fm-25vw-vh7f mcp-handler has a tool response leak across concurrent client sessions ('Race Condition') CWE-1395
• GHSA-32wq-ppwg-3w4m EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency… CWE-1395
• GHSA-46wh-3698-f2cx Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go… CWE-1395
• GHSA-vj2p-7pgw-g2wf Postiz App has a High-Severity SSRF Vulnerability via Next.js CWE-1395
• GHSA-h8w2-rv57-vc6f splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote… CWE-1395