Impact Score: 5/10
OpenTofu v1.11.9 — Release Notes & Engineering Impact
Source available — automated, not human-reviewed
Component: opentofu · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
OpenTofu v1.11.9. Source highlight: SECURITY ADVISORIES:
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
🔧 Bug Fixes & Patches (1)
- Fix race condition while handling closing signals during `tofu login`, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)
📄 View Raw Release Notes (Original Developer Log)
## 1.11.9
SECURITY ADVISORIES:
* Previous releases in the v1.11 series could be affected by several vulnerabilities:
* ssh usage through OpenTofu generate hangs or panics.
* Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
This is fixed now by ([#4145](https://github.com/opentofu/opentofu/pull/4145))
* If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted. ([#4177](https://github.com/opentofu/opentofu/pull/4177))
* Previous releases in the v1.11 series could be affected by several vulnerabilities:
* When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
* If using an attacker-controlled server to run `tofu` against, it might end up in high CPU consumption.
These are now fixed by ([#4248](https://github.com/opentofu/opentofu/pull/4248))
BUG FIXES:
- Fix race condition while handling closing signals during `tofu login`, both when the signal is sent by the user and when the browser fails to successfully connect. ([4016](https://github.com/opentofu/opentofu/pull/4016))
- Prevent panic when using ephemeral resources during tofu test`. ([#4254](https://github.com/opentofu/opentofu/pull/4253))
**Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.11.8...v1.11.9