CVE-2025-58185

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.24.9-alt1 OpenTofu versions <=2.10.0

Description The issue is a memory exhaustion flaw in the encoding/asn1 package of the Go programming language. The code pre-allocates memory based on fields within a DER structure before fully validating the correctness or content of those fields. Processing a maliciously crafted DER payload can lead to excessive memory allocation, potentially causing a denial-of-service condition. The vulnerability also affects OpenTofu, causing a denial of service in the tofu init function when processing maliciously crafted module package responses.

Recommendations Go versions prior to 1.24.9-alt1: Upgrade to version 1.24.9-alt1 or later. OpenTofu versions <=2.10.0: Update to a version greater than 2.10.0.