OpenTofu versions prior to 1.10.7 are vulnerable to denial of service during the 'tofu init' process when installing module packages from attacker-controlled sources. Maliciously crafted TLS certificate chains or tar archives can cause unbounded memory usage, high CPU consumption, or crashes. These issues do not allow code execution or data disclosure but can disrupt the installation process and degrade system performance. The vulnerabilities stem from underlying Go standard library components used by OpenTofu. OpenTofu 1.10.7 includes fixes by upgrading to Go 1.24.9. Versions 1.9 and 1.8 remain vulnerable with no upstream fix available. Operators are advised to upgrade or carefully review dependencies before installation.