CVE-2026-74797

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74797", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-16T12:59:42.223Z", "datePublished": "2026-08-16T13:14:19.060Z", "dateUpdated": "2026-10-08T15:24:47.106Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:24:47.106Z"}, "datePublic": "2026-01-21T00:00:00.000Z", "title": "OpenTofu before 1.11.4 Denial of Service via malicious zip", "descriptions": [{"lang": "en", "value": "OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Uncontrolled Resource Consumption", "cweId": "CWE-400", "type": "CWE"}]}], "affected": [{"vendor": "opentofu", "product": "opentofu", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.11.4"}, {"version": "1.11.4", "status": "unaffected", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/opentofu/opentofu"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 3.1, "baseSeverity": "LOW"}}], "references": [{"url": "https://github.com/opentofu/opentofu/security/advisories/GHSA-r92c-9c7f-3pj8", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-r92c-9c7f-3pj8)"}, {"name": "VulnCheck Advisory: OpenTofu before 1.11.4 Denial of Service via malicious zip", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/opentofu-before-denial-of-service-via-malicious-zip"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-17T17:42:48.391260Z", "id": "CVE-2026-74797", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-17T17:42:56.586Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74797", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T17:42:48.391260Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-17T17:42:53.066Z"}}], "cna": {"title": "OpenTofu before 1.11.4 Denial of Service via malicious zip", "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "opentofu", "product": "opentofu", "versions": [{"status": "affected", "version": "0", "lessThan": "1.11.4", "versionType": "semver"}, {"status": "unaffected", "version": "1.11.4", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/opentofu/opentofu", "defaultStatus": "unaffected"}], "datePublic": "2026-01-21T00:00:00.000Z", "references": [{"url": "https://github.com/opentofu/opentofu/security/advisories/GHSA-r92c-9c7f-3pj8", "name": "GitHub Security Advisory (GHSA-r92c-9c7f-3pj8)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/opentofu-before-denial-of-service-via-malicious-zip", "name": "VulnCheck Advisory: OpenTofu before 1.11.4 Denial of Service via malicious zip", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:24:47.106Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74797", "state": "PUBLISHED", "dateUpdated": "2026-10-08T15:24:47.106Z", "dateReserved": "2026-08-16T12:59:42.223Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-16T13:14:19.060Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/opentofu/opentofu", "product": "opentofu", "vendor": "opentofu", "versions": [{"lessThan": "1.11.4", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.11.4", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process."}], "id": "CVE-2026-74797", "lastModified": "2026-10-08T16:17:38.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74797", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-17T17:42:48.391260Z", "version": "2.0.3"}}]}, "published": "2026-08-16T14:16:57.930", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/opentofu/opentofu/security/advisories/GHSA-r92c-9c7f-3pj8"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/opentofu-before-denial-of-service-via-malicious-zip"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/opentofu/opentofu: OpenTofu: Denial of Service via malicious zip archives", "id": "2517222", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517222"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-400", "details": ["A flaw was found in OpenTofu. A remote attacker could exploit this vulnerability by providing maliciously-crafted .zip archives during the `tofu init` command, which is used for provider or module package initialization. This could lead to excessive CPU usage, causing a Denial of Service (DoS) by degrading system performance and preventing the completion of the initialization process."], "name": "CVE-2026-74797", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/opentofu", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "opentofu1.10", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "opentofu1.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "opentofu1.12", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-08-16T13:14:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74797\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74797\nhttps://github.com/opentofu/opentofu/security/advisories/GHSA-r92c-9c7f-3pj8\nhttps://www.vulncheck.com/advisories/opentofu-before-denial-of-service-via-malicious-zip"], "statement": "This Low impact denial of service vulnerability in OpenTofu affects the `tofu init` command when processing maliciously-crafted `.zip` archives. Exploitation requires an attacker to provide a malicious archive, necessitating user interaction or a compromised dependency supply chain, which limits the attack surface in Red Hat environments where `tofu init` is typically executed in controlled development or CI/CD pipelines.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.11.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.11.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "opentofu", "source": "cna", "vendor": "opentofu"}, "product": "opentofu", "vendor": "opentofu"}], "created": "2026-08-16T14:45:04.974369+00:00", "updated": "2026-08-17T10:58:26.061005+00:00", "vendors": ["opentofu", "opentofu$PRODUCT$opentofu"]}