GO-2026-4869 reported: tar reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive

[github-actions]

This vulnerability might affect the following versions: v1.10 v1.9

CVE-2026-32288

Vulnerability info: https://pkg.go.dev/vuln/GO-2026-4869
Pipeline run: https://github.com/opentofu/opentofu/actions/runs/24352087018

[apparentlymart]

We already released v1.11.6 with the new version of Go that addressed this advisory, after upgrading in #3966.

Therefore this issue just represents what kind of response we want to make for the two other release series that are still under security support but are using a version of Go that is not under security support.

[apparentlymart]

This advisory has essentially the same profile as GHSA-r92c-9c7f-3pj8: an attacker could cause unexpectedly high resource usage by coercing someone to try to install a maliciously-crafted module package. The previous advisory was about packages in .zip archives while this one is in "tar" archives, but the attack method and result are equivalent.

Therefore I suggest that we publish a similar security advisory in this case. The two situations are so similar that I imagine we can just lightly adapt the text we wrote for that previous advisory.

There is no fix available that is suitable for the OpenTofu v1.10 and v1.9 series, and so we should also adapt the text from GHSA-w2jf-268q-mrvh that discussed its impact on the v1.9 and v1.8 series, since the same is true for v1.10 and v1.9 here.

[apparentlymart]

We have now echoed this upstream advisory in GHSA-hw5x-4r37-72w7.