OpenTofu 1.12.8 Release Notes List a Go HTTP/2 CPU-Usage Fix for tofu init, While a Maintainer Proposes Shipping the v1.13 Backport in 1.13.2

Overview

OpenTofu v1.12.8 was published on October 14, 2026 at 16:20 UTC, according to its GitHub release page. The release notes carry one entry under “SECURITY ADVISORIES” and one bug fix. The security entry says: “Previous versions of OpenTofu could potentially experience excessive CPU usage if connecting to an attacker-controlled HTTP2 server while installing dependencies in tofu init.” The bug fix says: “Lifecycle destroy will no longer crash when given an expression with references”.

The release notes do not name a CVE. The linked pull request does, and the surrounding record shows the 1.13 line had not shipped the same fix when the Machine Herald checked the releases page on October 15.

What the Pull Requests Say

The security entry links to pull request #4700, titled “go.mod: Upgrade to Go 1.26.9 [v1.12 backport]” and merged into the v1.12 branch on October 14. Its description says the change is “primarily motivated by patching advisory GO-2026-6611, also known as CVE-2026-78669”. It also says the issue could affect OpenTofu “if someone publishes a module that refers to a dependency on an attacker-controlled server which intentionally causes excessive CPU consumption for the “tofu init” command.”

The author, who appears on GitHub as apparentlymart, wrote that OpenTofu’s “threat model generally expects operators to review dependencies before using them”. The description says the project nonetheless treats problems in dependency installation as slightly more serious “because operators often review dependencies only after having installed them, before running other commands.” It also notes that the separate lifecycle-destroy fix was already waiting unreleased on the v1.12 branch, so the two would be released together.

The Upstream Go Advisory

The Go vulnerability database entry GO-2026-6611 describes the underlying flaw: “A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.” It lists CVE-2026-78669 as an alias. For net/http it gives go1.26.9 as the fixed version. For net/http/internal/http2 it lists go1.27.0-0 before go1.27.2 as affected, with go1.27.2 as the fix. For golang.org/x/net/http2 the fixed version is v0.60.0. The Go release history shows both go1.26.9 and go1.27.2 as released on 2026-10-08.

Where the Fix Stands on Other Lines

A companion change, pull request #4681, upgrades the v1.13 branch to Go 1.27.2 and was merged on October 14. Its description says: “Since this is a low-severity advisory that leads only to excessive CPU usage (and not to elevated privilege) I propose that we just include it in the v1.13.2 release along with a few other v1.13.0 followup fixes, rather than publishing this standalone in its own patch release.” This is a proposal in a pull request description, not a published release schedule.

On the October 15 check, the releases page listed v1.12.8 as the newest release, followed by v1.13.1, which was published on October 1, and no v1.13.2. The go.mod file at the v1.13.1 tag declares go 1.27.1, while the v1.12.8 tag declares go 1.26.9. The go line in go.mod is a declared Go version, and the release page does not say which toolchain built the published binaries, so what those tags were built with is an inference from the declared versions and the pull requests, not a statement by the project.

Advisory Index

The project’s security advisories page listed ten advisories when checked, and the newest, GHSA-vxp5-g6gx-r4j2, was published on August 19, 2026. None of the ten is dated October, so the 1.12.8 entry has no corresponding advisory in that list. The reason is not stated in any page read for this article. The August advisory has a different title (“Excessive resource usage in ‘tofu init’ when interacting with attacker-controlled server”) and a different release history.

What We Don’t Know

• Whether the project will publish a GitHub Security Advisory for the HTTP/2 issue. Neither the release notes nor the pull requests say.
• When v1.13.2 will ship. The only statement is the proposal quoted above.
• Whether older supported lines are affected. Neither the release notes nor the two pull requests address OpenTofu 1.11, and this article does not assess it.
• The severity the OpenTofu project assigns. The v1.13 pull request calls it “low-severity”; the release notes give no rating.