Log in Start free

Vulnerability · Published Jan 26, 2026 · Assigned by redhat

CVE-2025-11065Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

Medium 5.3

In plain English

A medium-severity security flaw in github.com/go-viper/mapstructure/v2. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 55.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13golang-github-go-viper-mapstructureno fix listedDEBIAN-CVE-2025-11065
Debian:14golang-github-go-viper-mapstructure2.4.0-1DEBIAN-CVE-2025-11065
Gogithub.com/go-viper/mapstructureno fix listedGO-2025-3900
Gogithub.com/go-viper/mapstructure/v22.4.0GHSA-2464-8j7c-4cjm
Gogithub.com/go-viper/mapstructure/v22.4.0GO-2025-3900
Ubuntu:25.10golang-github-go-viper-mapstructureno fix listedUBUNTU-CVE-2025-11065
Ubuntu:26.04:LTSgolang-github-go-viper-mapstructureno fix listedUBUNTU-CVE-2025-11065
Ubuntu:26.10golang-github-go-viper-mapstructureno fix listedUBUNTU-CVE-2025-11065

Affected products (as reported)

VendorProductVersions
github.com/go-viper/mapstructure/v2 0 – before 2.4.0
Red Hat OpenShift Pipelines see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 see references
Red Hat Red Hat Advanced Cluster Security 4 see references
Red Hat Red Hat Advanced Cluster Security 4 see references
Red Hat Red Hat Advanced Cluster Security 4 see references
Red Hat Red Hat Advanced Cluster Security 4 see references
Red Hat Red Hat Advanced Cluster Security 4 see references
Red Hat Red Hat Advanced Cluster Security 4 see references
Red Hat Red Hat Certification for Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Certification Program for Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Dev Spaces see references
Red Hat Red Hat OpenShift Dev Spaces see references
Red Hat Red Hat OpenShift Dev Spaces see references
Red Hat Red Hat OpenShift distributed tracing 3 see references
Red Hat Red Hat OpenShift GitOps see references

Weakness: CWE-209 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References