CVE-2025-11065

Summary

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

Affected Software

Weaknesses

• CWE-209: Generation of Error Message Containing Sensitive Information

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm

References

• https://access.redhat.com/security/cve/CVE-2025-11065
• https://bugzilla.redhat.com/show_bug.cgi?id=2391829
• https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c
• https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm

• ←Previous
• Next→