Back Linuxsecurity

Fedora 43: opentofu Critical DoS Memory Exhaustion Advisory 2025

Linuxsecurity •LinuxSecurity Advisories • December 29, 2025

OpenTofu lets you declaratively manage your cloud infrastructure. Update Information : Update to 1.11.2

OpenTofu lets you declaratively manage your cloud infrastructure.

* Fri Dec 19 2025 Mikel Olasagasti Uranga - 1.11.2-1 - Update to 1.11.2 - Closes rhbz#2420199

[ 1 ] Bug #2408335 - CVE-2025-58189 opentofu: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-43] [ 2 ] Bug #2408738 - CVE-2025-61725 opentofu: Excessive CPU consumption in ParseAddress in net/mail [fedora-43] [ 3 ] Bug #2409808 - CVE-2025-61723 opentofu: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-43] [ 4 ] Bug #2410758 - CVE-2025-58185 opentofu: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-43] [ 5 ] Bug #2411654 - CVE-2025-58188 opentofu: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-43]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-6968ab200a' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora 43: Critical Vulnerabilities in OpenTofu and chezmoi Fedora 43 has issued critical advisories for two vulnerabilities affecting OpenTofu and chezmoi. OpenTofu version 1.11.2 addresses a memory exhaustion issue, while chezmoi version 2.68.1 resolves excessive CPU usage problems. Both vulnerabilities could impact users managing cloud infrastructure and dotfiles across multiple machines. 2 sources 34

Extracted Entities

Fedora 43: opentofu Critical DoS Memory Exhaustion Advisory 2025

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (5)

Platforms (1)