Skip to content
Fencer Vulns
medium 5.3

CVE-2025-11065 json

Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

published 2025-08-21 14 mo ago modified 2026-11-05 3 d ago also GHSA-2464-8j7c-4cjm , GO-2025-3900 , EUVD-2025-29426

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

Patch / fix

  • go github.com/go-viper/mapstructure/v2 2.4.0
  • golang-github-go-viper-mapstructure Debian 14 2.4.0-1

debian advisories DEBIAN-CVE-2025-11065

  • cosign SLES for SAP applications 16.0, SLES 16.0 3.0.5-160000.1.1
  • cosign SLE Module for Basesystem 15 SP7, openSUSE Leap 15.6 3.0.5-150400.3.35.1
  • grafana SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 11.5.10-150200.3.80.1
  • release-notes-susemanager Manager Server LTS 4.3 4.3.16.2-150400.3.148.1
  • release-notes-susemanager-proxy Manager Proxy LTS 4.3 4.3.16.2-150400.3.104.2
  • rhnlib Manager Client Tools 15 5.0.6-150000.3.49.1
  • grafana Manager Client Tools 15 11.5.10-150000.1.87.1
  • mgr-push Manager Client Tools 15 5.0.3-150000.1.30.1

suse advisories SUSE-SU-2026:20904-1SUSE-SU-2026:0777-1SUSE-SU-2025:4482-1SUSE-SU-2025:4479-1SUSE-SU-2025:4458-1SUSE-SU-2025:4457-1

  • cosign openSUSE Leap 16.0 3.0.5-160000.1.1
  • cosign openSUSE Tumbleweed 3.0.4-2.1
  • alloy openSUSE Leap 16.0 1.11.3-160000.1.1
  • trivy openSUSE Tumbleweed 0.67.2-1.1
  • alloy openSUSE Tumbleweed 1.11.2-2.1
  • grafana openSUSE Tumbleweed 11.6.6-1.1

opensuse advisories openSUSE-SU-2026:20386-1openSUSE-SU-2026:10232-1openSUSE-SU-2025:20073-1openSUSE-SU-2025:15724-1openSUSE-SU-2025:15631-1openSUSE-SU-2025:15610-1

  • cert-manager Azure Linux 3.0 1.12.15-6
  • coredns Azure Linux 3.0 1.11.4-14
  • docker-buildx Azure Linux 3.0 0.14.0-10
  • docker-cli Azure Linux 3.0 25.0.7-2
  • docker-compose Azure Linux 3.0 2.27.0-8
  • gh Azure Linux 3.0 2.62.0-13
  • cert-manager CBL-Mariner 2.0 1.11.2-27
  • influxdb Azure Linux 3.0 2.7.5-13

azure linux advisories AZL-75389AZL-75407AZL-75410AZL-75413AZL-75416AZL-75419

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-11065 updated cvss 5.3

github.com/go-viper/mapstructure/v2: Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure

  • Red Hat OpenShift Pipelines openshift-pipelines-client
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel9, rhacm2/submariner-rhel9-operator Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-v4-rhel8, advanced-cluster-security/rhacs-scanner-v4-db-rhel8 Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-preflight Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-preflight Red Hat Enterprise Linux 9 toolbox, toolbox-tests, gvisor-tap-vsock, opentelemetry-collector, gvisor-tap-vsock-gvforwarder Red Hat Enterprise Linux 10 toolbox, gvisor-tap-vsock, opentelemetry-collector
    +1 more products
    Red Hat OpenShift AI (RHOAI) rhoai/odh-rhel9-operator, rhoai/odh-model-registry-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 4 podman, openshift, microshift, podman-tests, podman-docker, podman-remote, +31 more
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 3 rhosdt/opentelemetry-collector-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Trusted Application Pipeline rhtap-task-runner/rhtap-task-runner-rhel9 Red Hat Trusted Artifact Signer rhtas/cosign-rhel9, rhtas/fulcio-rhel9, rhtas/gitsign-rhel9, rhtas/rekor-cli-rhel9, rhtas/rekor-server-rhel9, rhtas/timestamp-authority-rhel9, +1 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Zero Trust Workload Identity Manager - Tech Preview zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9, zero-trust-workload-identity-manager/spiffe-spire-server-rhel9, zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9, zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Dev Spaces devspaces/udi-rhel9, devspaces/udi-base-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
9 mo ago

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/go-viper/mapstructure/v2
<2.4.0
2.4.0
go github.com/go-viper/mapstructure
all versions
 no fix listed

Affected products

  • Red Hat OpenShift Pipelines
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Advanced Cluster Security 4
  • Red Hat Red Hat Certification for Red Hat Enterprise Linux 8
  • Red Hat Red Hat Certification Program for Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Red Hat OpenShift distributed tracing 3
  • Red Hat Red Hat OpenShift GitOps
  • Red Hat Red Hat Trusted Application Pipeline
  • Red Hat Red Hat Trusted Artifact Signer
  • Red Hat Zero Trust Workload Identity Manager - Tech Preview

Classification

Weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information
  • CWE-117 Improper Output Neutralization for Logs

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.