v1.17.0-rc2
2026-10-15T08:51:34Z•350663ed9ff5629fd3a6178dad020935795489e9b1978d569ac7665d8b079df4
CVE-2026-78669HTTP/2HashiCorpTerraformcloud infrastructuredenial of servicemodule registryprovider registryrelease updateresource exhaustion
What happened
HashiCorp Terraform 1.16.6 addresses CVE-2026-78669, a potential HTTP/2 resource-exhaustion vulnerability. Exploitation requires a compromised, untrusted provider or module registry and is described as outside Terraform core’s normal security perimeter. The release also includes cloud workspace tag handling and testing fixes. The 1.17.0 release candidates and betas add policy, planning, provider-requirement, and testing enhancements but are not security fixes in the supplied data.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hashicorp_terraform_releases
- Record identifier
- 350663ed9ff5629fd3a6178dad020935795489e9b1978d569ac7665d8b079df4
- Enrichment time
- 2026-10-15T08:51:34Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.