CVE-2025-11065 Details
Description
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
A vulnerability in the Go-Viper Mapstructure library, specifically in version 2.3.0 and prior, has been identified. The issue arises in the field processing component that utilizes 'mapstructure.WeakDecode', which can lead to unauthorized information disclosure. This vulnerability allows sensitive input values to be leaked through detailed error messages, when malformed user-supplied data is processed in contexts where security is critical.
Users are advised to upgrade to Mapstructure version 2.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 26, 2026CISA-ADP
Assessed Feb 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm | CISA-ADP | AdvisoryRemedyVendor |
| https://access.redhat.com/security/cve/CVE-2025-11065 | [email protected] | AdvisoryPartial Content |
| https://bugzilla.redhat.com/show_bug.cgi?id=2391829 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c | [email protected] | Source CodeVendor |
| https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-209 | Generation of Error Message Containing Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| github.com/go-viper/mapstructure/v2 | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | CVE Modified | [email protected] |
| Jun 25, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 3, 2026 | CVE Modified | CISA-ADP |
| Jan 26, 2026 | New CVE Received | [email protected] |