v1.17.1
2026-11-07T08:51:35Z•8d6d1150bda485ff588756a9c11cea97a28d96e5a0d72e4c1af25490fd87efb2
CVE-2026-111943CVE-2026-78669GoHTTP/2 resource exhaustionHashiCorpTerraformcertificate validationcloud infrastructuremodule registrypolicy as codeprovider registrysecurity updatesoftware release
What happened
HashiCorp Terraform releases from September–October 2026 include new policy capabilities, minimal-refresh planning, provider requirement variables, and multiple bug fixes. Security-relevant updates include mitigation of HTTP/2 resource exhaustion in v1.16.6, exploitable only through a compromised untrusted provider or module registry, and updated Go certificate trust behavior in v1.16.7 to distrust certificates issued through compromised eMudhra intermediate CAs. Users should upgrade to the latest stable release, v1.17.1, or at minimum apply the relevant security fixes.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hashicorp_terraform_releases
- Record identifier
- 8d6d1150bda485ff588756a9c11cea97a28d96e5a0d72e4c1af25490fd87efb2
- Enrichment time
- 2026-11-07T08:51:35Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.