Junglewise Threat Intelligence

CVE-2025-11065: go-viper mapstructure information disclosure in WeakDecode

CVE-2025-11065 · Severity: medium · CVSS 5.3 · Published 2026-01-26

Technologies: Red Hat Advanced Cluster Security for Kubernetes. Vendors: Red Hat, Go.

Executive brief

A vulnerability in a popular Go programming library used for data processing could allow sensitive information to be leaked in system logs. If an application uses this library to handle sensitive data like passwords or security tokens, a specially crafted but malformed request could trigger an error message that includes the sensitive value in plain text. This could allow unauthorized individuals with access to system logs to view private data.

Technical details

A flaw was found in the github.com/go-viper/mapstructure/v2 library within the field processing component. When using mapstructure.WeakDecode, the library may generate detailed error messages that include the original input values when a type conversion fails (e.g., via strconv or time.ParseDuration). If the library is used to process sensitive fields in a security-critical context, an attacker can provide malformed data to trigger these errors, causing the sensitive values to be leaked into application logs or error responses. This is a regression or secondary path related to previous information disclosure fixes. The issue is resolved in version 2.4.0.

Affected products

  • go-viper mapstructure/v2 < 2.4.0
  • Red Hat OpenShift Pipelines
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Advanced Cluster Security 4

Timeline

  • 2025-08-20: advisory: GitHub Security Advisory published
  • 2025-08-29: other: Bugzilla record created
  • 2026-01-26: disclosed: CVE published to NVD

References

Related threats