Plan active

OpenTofu v1.12.8: HTTP/2 CPU exhaustion security fix

2026-10-19 18:19 UTC · Releases: opentofu · read the source ↗ #opentofu #security #infrastructure-as-code

Platform/SRE — Plan: Upgrade OpenTofu to v1.12.8 to address a CPU exhaustion vulnerability reachable via attacker-controlled HTTP/2 servers during tofu init; no KEV listing or active exploitation reported, so no hard deadline, but schedule patching this sprint.
CI/CD — Plan: If pipelines run tofu init against untrusted or external registries, upgrade to v1.12.8 to close the HTTP/2 CPU exhaustion vector; no confirmed exploitation or pipeline-breaking deadline, so plan within current cycle.
Leader — Skip

This entry was curated and judged by AI (Claude) with automated enrichment (CISA KEV / EPSS / public PoC). Verify against the original source before acting. Found a bad verdict? Report it — confirmed errors go to the corrections log.