CVE-2025-11065: go-viper mapstructure information disclosure in WeakDecode

CVE-2025-11065 · Severity: medium · CVSS 5.3 · Published 2026-01-26

A vulnerability in a popular Go programming library used for data processing could allow sensitive information to be leaked in system logs. If an application uses this library to handle sensitive data like passwords or security tokens, a specially crafted but malformed request could trigger an error message that includes the sensitive value in plain text. This could allow unauthorized individuals with access to system logs to view private data.

Technologies: github.com/go-viper/mapstructure/v2 (Go), Red Hat Advanced Cluster Security for Kubernetes. Vendors: Go, Red Hat.

Quick answers

Is CVE-2025-11065 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-11065 being exploited in the wild.
How severe is CVE-2025-11065?
Medium severity, with a CVSS score of 5.3, published 26 January 2026.
Which products and versions are affected?
github.com/go-viper/mapstructure (Go) SEMVER:introduced=0; github.com/go-viper/mapstructure/v2 (Go) SEMVER:introduced=0,fixed=2.4.0; Viper Mapstructure < 2.4.0.
Is there a fix for CVE-2025-11065?
Yes. github.com/go-viper/mapstructure/v2 (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-11065 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-11065?
Check whether you run github.com/go-viper/mapstructure (Go), github.com/go-viper/mapstructure/v2 (Go), Red Hat Advanced Cluster Security for Kubernetes or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/go-viper/mapstructure/v2 (Go): upgrade to 2.4.0 or later
    go get github.com/go-viper/mapstructure/v2@v2.4.0

Technical details

A flaw was found in the github.com/go-viper/mapstructure/v2 library within the field processing component. When using mapstructure.WeakDecode, the library may generate detailed error messages that include the original input values when a type conversion fails (e.g., via strconv or time.ParseDuration). If the library is used to process sensitive fields in a security-critical context, an attacker can provide malformed data to trigger these errors, causing the sensitive values to be leaked into application logs or error responses. This is a regression or secondary path related to previous information disclosure fixes. The issue is resolved in version 2.4.0.

Affected products

  • go-viper mapstructure/v2 < 2.4.0
  • Red Hat OpenShift Pipelines
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Advanced Cluster Security 4

Identifiers

  • CVE-2025-11065
  • GHSA-2464-8j7c-4cjm
  • GO-2025-3900

Timeline

  • 2025-08-20: advisory: GitHub Security Advisory published
  • 2025-08-29: other: Bugzilla record created
  • 2026-01-26: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.