—
GO-2026-6262
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers in github.com/opentofu/opentofu
Quick fix
GO-2026-6262 — github.com/opentofu/opentofu: upgrade to the fixed version with the command below.
go get github.com/opentofu/opentofu@v1.11.9Details
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers in github.com/opentofu/opentofu
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/opentofu/opentofu
Introduced in:
0 Fixed in: 1.11.9 Fix
go get github.com/opentofu/opentofu@v1.11.9 References
- https://github.com/opentofu/opentofu/security/advisories/GHSA-22w5-2fxg-vrwx [ADVISORY]
- https://github.com/opentofu/opentofu/issues/4242 [REPORT]
- https://github.com/opentofu/opentofu/issues/4243 [REPORT]
- https://github.com/opentofu/opentofu/issues/4244 [REPORT]
- https://github.com/opentofu/opentofu/releases/tag/v1.11.9 [WEB]
- https://github.com/opentofu/opentofu/releases/tag/v1.12.2 [WEB]