OpenTofu 1.12.8
security*!
OpenTofu v1.12.8 fixes excessive CPU usage that could occur when tofu init installs dependencies from an attacker-controlled HTTP/2 server. It also fixes a crash in lifecycle destroy when the destroy expression contains references.
What changes for platform teams
Teams running tofu init against untrusted or unverified module sources should upgrade to remove the CPU exhaustion risk. Pipelines that use lifecycle destroy with referenced expressions will no longer crash.
Changes
- Previous versions of OpenTofu could potentially experience excessive CPU usage if connecting to an attacker-controlled HTTP2 server while installing dependencies in tofu init.security
- Lifecycle destroy will no longer crash when given an expression with referencesfixed
2 lines1 security1 fixedtyped from the source notes
Full release notes ↗ · all OpenTofu releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules