OpenTofu

OpenTofu v1.12.8 fixes excessive CPU usage that could occur when tofu init installs dependencies from an attacker-controlled HTTP/2 server. It also fixes a crash in lifecycle destroy when the destroy expression contains references.

platform teams Teams running tofu init against untrusted or unverified module sources should upgrade to remove the CPU exhaustion risk. Pipelines that use lifecycle destroy with referenced expressions will no longer crash.

written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

• !Previous versions of OpenTofu could potentially experience excessive CPU usage if connecting to an attacker-controlled HTTP2 server while installing dependencies in tofu init.security
• *Lifecycle destroy will no longer crash when given an expression with referencesfixed

• *Tofu show -json <planfile> now works again when ephemeral resources are present in the configuration. (4623).fixed
• *Ephemeral output values are now always re-evaluated during the apply phase, instead of sometimes using stale values from the planning phase.fixed

OpenTofu v1.12.7 fixes a deadlock that could occur when remote-exec or file provisioners connect to an attacker-controlled SSH server, where the server could hang the connection by sending unexpected packet types. The release also addresses two upstream Go security advisories, CVE-2026-78662 and CVE-2026-56855.

platform teams Platform teams running OpenTofu with provisioners that connect to external hosts should upgrade to pick up the connection-handling fix. The Go advisory fixes are toolchain dependency updates and do not change how platform workflows are run.

written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

• !When using either a remote-exec or file provisioner to connect to an attacker-controlled SSH server, the server could previously deadlock the connection by sending certain unexpected packet types.security
• !This addresses the upstream Go security advisories CVE-2026-78662 and CVE-2026-56855.security

• !When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect.security
• !When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses.security

• !When interacting with OCI Distribution registries for module or provider package installation, previous versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect.security
• !When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses.security

• !Previous releases in the v1.12 series could be affected by several vulnerabilities:security
• !The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake,security
• *Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceStatefixed

• !Previous releases in the v1.11 series could be affected by several vulnerabilities:security
• !The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake,security
• *Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceStatefixed

• *Tofu plan -out no longer fails when the plan includes a resource with lifecycle { destroy = false } that needs replacement, which previously errored with invalid change action ForgetThenCreate.fixed
• *Moved block now correctly compares provider source addresses. (#4280)[fixed
• *Correct Source Provider Address now passed into Provider MoveResource requests. (#4355)[fixed

• *Moved block now correctly compares provider source addresses. (#4280)[fixed
• *Correct Source Provider Address now passed into Provider MoveResource requests. (#4355)[fixed

• *Fixes an incomplete OTEL dependencies upgrade from the previous patch release.fixed