CVE-2025-11065: Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

Deferred

AliasesUBUNTU-CVE-2025-11065DEBIAN-CVE-2025-11065CGA-568j-2h93-4c84+151 more

Published 26-01-2026Last modified 29-06-2026

Vulnerability summary

CVE-2025-11065 is a medium (CVSS 5.3) vulnerability in bank-vaults. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 37.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.43%

0%100%

Low · +0.03 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 17

OPENSUSE-SU-2025:15631-1 OPENSUSE-SU-2025:20073-1 OPENSUSE-SU-2025:20117-1 OPENSUSE-SU-2026:10232-1 OPENSUSE-SU-2026:20386-1 SUSE-SU-2025:21137-1+11 more

Timeline

26-01-2026
PublishedVulnerability first disclosed.
29-06-2026
Last modifiedVulnerability information updated.

Description

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

CVSS metrics

7 scores · 7 sources · 1 version

v3.15.3

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

Increase +0.03 pp

From 0.41% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-209Generation of Error Message Containing Sensitive InformationThe product generates an error message that includes sensitive information about its environment, users, or associated data.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard74 products

auditbeat-9.1< 9.1.2-r3
auditbeat-9.1-oci-entrypoint< 9.1.2-r3
auditbeat-fips-9.1< 9.1.2-r3
bank-vaults< 1.32.0-r1
bank-vaults-template< 1.32.0-r1

beats-9.1< 9.1.2-r3
beats-fips-9.1< 9.1.2-r3
boring-registry-fips< 0.16.4-r5
docker-compose-fips< 2.39.2-r1
filebeat-9.1< 9.1.2-r3
filebeat-9.1-oci-entrypoint< 9.1.2-r3
filebeat-fips-9.1< 9.1.2-r3
gitlab-logger-18.3< 18.3.1-r0
gitlab-logger-fips-18.3< 18.3.1-r0
grafana-11.3< 11.3.9-r3
grafana-11.5< 11.5.8-r1
grafana-11.5-oci-compat< 11.5.8-r1
grafana-11.6< 11.6.5-r1
grafana-11.6-oci-compat< 11.6.5-r1
grafana-fips-11.6< 11.6.5-r1
grafana-fips-11.6-oci-compat< 11.6.5-r1
grafana-fips-12.1< 12.1.1-r1
grafana-fips-12.1-oci-compat< 12.1.1-r1
grafana-fips-13.2All versions (No fix recorded)
heartbeat-9.1< 9.1.2-r3
heartbeat-9.1-oci-entrypoint< 9.1.2-r3
heartbeat-fips-9.1< 9.1.2-r3
heartbeat-fips-9.1-oci-entrypoint< 9.1.2-r3
istio-cni-fips-1.27< 1.27.0-r3
istio-cni-fips-1.27-compat< 1.27.0-r3
istio-fips-1.27< 1.27.0-r3
istio-install-cni-fips-1.27< 1.27.0-r3
istio-install-cni-fips-1.27-compat< 1.27.0-r3
istio-pilot-agent-fips-1.27< 1.27.0-r3
istio-pilot-agent-fips-1.27-compat< 1.27.0-r3
istio-pilot-discovery-fips-1.27< 1.27.0-r3
jitsucom-bulker< 2.11.0-r2
k9s-fips< 0.50.9-r6
kyverno-1.14< 1.14.4-r6
kyverno-background-controller-1.14< 1.14.4-r6
kyverno-cleanup-controller-1.14< 1.14.4-r6
kyverno-cli-1.14< 1.14.4-r6
kyverno-init-container-1.14< 1.14.4-r6
kyverno-notation-aws-fips< 1.1-r22
kyverno-reports-controller-1.14< 1.14.4-r6
mattermost-10.12All versions (No fix recorded)
mattermost-10.12-compatAll versions (No fix recorded)
mattermost-fips-10.12< 10.12.0-r1
mattermost-fips-10.12-compat< 10.12.0-r1
metricbeat-9.1< 9.1.2-r3
metricbeat-9.1-oci-entrypoint< 9.1.2-r3
metricbeat-fips-9.1< 9.1.2-r3
neuvector-sigstore-interface-fips< 0_git20250825-r0
opentelemetry-operator-fipsAll versions (No fix recorded)
pluto-fips< 5.22.5-r1
pluto-fips-compat< 5.22.5-r1
rancher-security-scan-0.4< 0.4.5-r2
ratify-fips< 1.4.0-r5
ratify-fips-compat< 1.4.0-r5
ratify-fips-crds< 1.4.0-r5
ratify-fips-licensechecker< 1.4.0-r5
ratify-fips-licensechecker-compat< 1.4.0-r5
ratify-fips-sbom< 1.4.0-r5
ratify-fips-sbom-compat< 1.4.0-r5
ratify-fips-schemavalidator< 1.4.0-r5
ratify-fips-schemavalidator-compat< 1.4.0-r5
ratify-fips-vulnerabilityreport< 1.4.0-r5
ratify-fips-vulnerabilityreport-compat< 1.4.0-r5
tfsecAll versions (No fix recorded)
tkn-fips< 0.42.0-r1
zitadel-3< 3.4.0-r0
zitadel-3-compat< 3.4.0-r0
zitadel-4< 4.0.3-r0
zitadel-4-compat< 4.0.3-r0

Show all 74

Wolfi4 products

bank-vaults< 1.32.0-r1
bank-vaults-template< 1.32.0-r1
jitsucom-bulker< 2.11.0-r2
tfsecAll versions (No fix recorded)

Opensuse2 products

grafana&distro=openSUSE Tumbleweed< 11.6.6-1.1
trivy&distro=openSUSE Tumbleweed< 0.67.2-1.1

Debian1 product

golang-github-go-viper-mapstructureAll versions (No fix recorded) | < 2.4.0-1

Github.com/go-viper1 product

mapstructureAll versions (No fix recorded)

Github.com/go-viper/mapstructure1 product

v2< 2.4.0

Ubuntu1 product

golang-github-go-viper-mapstructureAll versions (No fix recorded)

7 vendors · 84 products

References

14 links

access.redhat.com/security/cve/CVE-2025-11065VDB EntryX Refsource REDHATAdvisoryWEB
bugzilla.redhat.com/show_bug.cgi?id=2391829Issue TrackingX Refsource REDHATREPORTWEB
github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39cREPORTFIXWEB
github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjmREPORTAdvisoryWEB
ubuntu.com/security/CVE-2025-11065REPORT
www.cve.org/CVERecord?id=CVE-2025-11065REPORT
security-tracker.debian.org/tracker/CVE-2025-11065Advisory
access.redhat.com/downloads/content/package-browser/WEB
github.com/go-viper/mapstructure/WEB
github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11065.jsonAdvisory

Show all 14 references

nvd.nist.gov/vuln/detail/CVE-2025-11065AdvisoryOval
github.com/go-viper/mapstructurePACKAGE
pkg.go.dev/vuln/GO-2025-3900WEB
www.suse.com/security/cve/CVE-2025-11065WEB