CVE-2025-11065
Aliases:GHSA-2464-8j7c-4cjmGO-2025-3900DEBIAN-CVE-2025-11065CGA-568j-2h93-4c84CGA-7c96-q25w-fwjmCGA-f437-fpvf-p49wCGA-jhmc-32j9-rqhwCGA-m2w5-2fj2-q666CGA-p3mh-xw66-wxmfCGA-2h3g-37xc-6283CGA-2mvx-qhpx-x9mfCGA-2rrp-8hrh-rg6wCGA-2x5p-45f4-cg5rCGA-32g7-c3cv-9hfvCGA-3g3v-hpfq-3qxqCGA-3pmj-5qx7-827mCGA-3pqm-8hr9-mwqmCGA-3w2x-3j63-rfrhCGA-43c2-3v4h-pvxhCGA-43vx-mp8x-q4g5CGA-44pw-vqr4-wwcmCGA-44q2-vm93-c369CGA-4x8r-27fc-22v5CGA-54rh-qx5q-2hgfCGA-5567-rvmx-599hCGA-57vf-7p2q-2x2rCGA-5975-cpg3-qcrvCGA-5p8m-hqq2-9wh6CGA-66wp-gpxm-9ff5CGA-67vv-5w5c-hx4vCGA-67xr-23wx-xfvcCGA-6g33-hr4r-xwpwCGA-6wxh-9q6h-xv6cCGA-74gm-55fr-6gqjCGA-7529-pw9h-x4vgCGA-776j-xhmx-ppgjCGA-7g28-7j8x-r6jjCGA-7hgq-4qh9-h2xgCGA-7hhg-922x-p77cCGA-7hr9-mcrh-5x7hCGA-7mr6-93jv-gwf3CGA-82mv-58rj-mjjpCGA-865q-73jh-g48wCGA-87rr-wcqv-9xw8CGA-8g5g-p8qw-3fg2CGA-8g76-x4cv-2fh3CGA-8h4m-v8vr-mv37CGA-8hr5-hwww-mv62CGA-8hxf-7cxm-4w8hCGA-8v8x-gh4v-hrcxCGA-94vf-jr6w-xm9hCGA-9656-gf2h-84rjCGA-9cwg-8hrp-4qmcCGA-9jcc-fxw5-jrcqCGA-9r67-j5wq-q866CGA-9x8x-95vx-5hhjCGA-cc2h-fpgr-274mCGA-cc3x-wj8p-qf36CGA-cf3m-gchh-g7r2CGA-cfcj-c235-ch9jCGA-chrj-7jgq-ph4xCGA-cr9v-x37h-6299CGA-crg6-j3qx-f78xCGA-cvm4-qvfp-jfw2CGA-cw7c-pp44-5gm5CGA-f4qp-8q77-px9xCGA-f58r-q944-9hxfCGA-f59p-c6gg-xfh2CGA-f8pq-8599-pwrqCGA-f92j-7h8r-ch95CGA-f98j-x8jv-r8mqCGA-f9gx-6gg2-j5vgCGA-fcmj-7wfq-2j6pCGA-ffx2-4fqf-5r3fCGA-fr4f-hjq3-7v26CGA-fv27-q2fg-mpqrCGA-fv57-jf9r-5c3cCGA-fx55-qw7h-52fpCGA-fx9x-hj7v-qrqcCGA-g66q-gpf7-j354CGA-g722-6h57-84hwCGA-g7mg-5g3p-qcrcCGA-g7q2-vx46-r9jwCGA-g835-82rq-4jq7CGA-g8f5-gcmr-mpfmCGA-gcjf-37f7-5jq4CGA-gf4f-v9cg-qxf8CGA-gf4m-r4xf-gj77CGA-gj27-gvgh-4865CGA-gmf6-c838-2j55CGA-gvm5-7f28-2pqjCGA-gxxm-9762-hqrhCGA-hc5r-h4c5-vw87CGA-hgcg-ghxr-7964CGA-hjmm-cc7j-c2ggCGA-hr44-5c9x-q2q2CGA-j2p5-pp6r-r7xhCGA-j38c-9jq8-8m53CGA-j5rm-mx9g-pf72CGA-j5rw-wp88-phghCGA-j5wv-rmqf-8f65CGA-j95w-rhpx-qwrqCGA-jg94-2g3c-q2hqCGA-jprm-329w-5cwrCGA-jq79-qpwg-35w8CGA-jx57-x7jm-rf4rCGA-jxj3-qpjv-x3j6CGA-m9rr-5838-mfj6CGA-mhcc-q7pm-r826CGA-mq5g-7g5f-qwqrCGA-p6wv-67cq-45gfCGA-p9wx-47gw-jwhgCGA-pr76-qhvq-386wCGA-pvmw-vpr9-xx45CGA-pw85-jfrq-wg65CGA-q7m9-j556-3928CGA-q8f9-4274-3rrxCGA-q8vx-pffx-62r6CGA-qfjf-qwpw-9xv6CGA-qq5m-mcxh-j8wrCGA-qwqc-xmc2-fq75CGA-r2x4-p227-xh5pCGA-r8gj-r9r6-pjvrCGA-r923-4p9j-q423CGA-r9mw-gwvh-6qqrCGA-rmg7-2cqc-cprjCGA-rrhv-hwvh-hvpqCGA-v82c-vcxp-6j99CGA-v89p-35g5-c8rjCGA-v8fj-3q5r-c8p8CGA-v8v8-m872-vrh2CGA-vg43-374p-vrg6CGA-vg9j-3gh9-9xwgCGA-vm25-2pp2-v35vCGA-vp3p-5546-79j5CGA-vvw4-gf47-3vp9CGA-vxqf-5v69-3ggmCGA-wfq4-mq4j-gqwmCGA-wg87-cvf7-hc33CGA-wjrw-q85m-x7pqCGA-wqr6-cwxf-v64cCGA-x6rh-553g-p3c4CGA-xc7w-fjpp-jh6hCGA-xfgv-qmrp-2j86CGA-xphv-gpj7-fr4wCGA-xrh4-q3jx-2fp5CGA-xxv8-x8mv-8hcr
Advisory lineage Upstream: 0 Downstream: 19
Deferred
Published: 26 Jan 2026, 19:36
Last modified:29 Jun 2026, 23:28
Vulnerability Summary
Overall Risk (default)
low
21/100 CVSS Score
5.3 MEDIUM
v3.1 (cve.org)
EPSS Score
0.37% LOW
0% probability +0.36%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
26 Jan 2026, 19:36
Published
Vulnerability first disclosed
29 Jun 2026, 23:28
Last Modified
Vulnerability information updated
Description
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
CVSS Metrics
- v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Trends
Current EPSS score: 0.37%• Percentile: 31%
Techniques & Countermeasures
- CWE-209•Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Affected Systems
- chainguard•auditbeat-9.1
< 9.1.2-r3
- chainguard•auditbeat-9.1-oci-entrypoint
< 9.1.2-r3
- chainguard•auditbeat-fips-9.1
< 9.1.2-r3
- chainguard•bank-vaults
< 1.32.0-r1
- chainguard•bank-vaults-template
< 1.32.0-r1
- chainguard•beats-9.1
< 9.1.2-r3
- chainguard•beats-fips-9.1
< 9.1.2-r3
- chainguard•boring-registry-fips
< 0.16.4-r5
- chainguard•docker-compose-fips
< 2.39.2-r1
- chainguard•filebeat-9.1
< 9.1.2-r3
- chainguard•filebeat-9.1-oci-entrypoint
< 9.1.2-r3
- chainguard•filebeat-fips-9.1
< 9.1.2-r3
- chainguard•gitlab-logger-18.3
< 18.3.1-r0
- chainguard•gitlab-logger-fips-18.3
< 18.3.1-r0
- chainguard•grafana-11.3
< 11.3.9-r3
- chainguard•grafana-11.5
< 11.5.8-r1
- chainguard•grafana-11.5-oci-compat
< 11.5.8-r1
- chainguard•grafana-11.6
< 11.6.5-r1
- chainguard•grafana-11.6-oci-compat
< 11.6.5-r1
- chainguard•grafana-fips-11.6
< 11.6.5-r1
- chainguard•grafana-fips-11.6-oci-compat
< 11.6.5-r1
- chainguard•grafana-fips-12.1
< 12.1.1-r1
- chainguard•grafana-fips-12.1-oci-compat
< 12.1.1-r1
- chainguard•heartbeat-9.1
< 9.1.2-r3
- chainguard•heartbeat-9.1-oci-entrypoint
< 9.1.2-r3
- chainguard•heartbeat-fips-9.1
< 9.1.2-r3
- chainguard•heartbeat-fips-9.1-oci-entrypoint
< 9.1.2-r3
- chainguard•istio-cni-fips-1.27
< 1.27.0-r3
- chainguard•istio-cni-fips-1.27-compat
< 1.27.0-r3
- chainguard•istio-fips-1.27
< 1.27.0-r3
- chainguard•istio-install-cni-fips-1.27
< 1.27.0-r3
- chainguard•istio-install-cni-fips-1.27-compat
< 1.27.0-r3
- chainguard•istio-pilot-agent-fips-1.27
< 1.27.0-r3
- chainguard•istio-pilot-agent-fips-1.27-compat
< 1.27.0-r3
- chainguard•istio-pilot-discovery-fips-1.27
< 1.27.0-r3
- chainguard•jitsucom-bulker
< 2.11.0-r2
- chainguard•k9s-fips
< 0.50.9-r6
- chainguard•kyverno-1.14
< 1.14.4-r6
- chainguard•kyverno-background-controller-1.14
< 1.14.4-r6
- chainguard•kyverno-cleanup-controller-1.14
< 1.14.4-r6
- chainguard•kyverno-cli-1.14
< 1.14.4-r6
- chainguard•kyverno-init-container-1.14
< 1.14.4-r6
- chainguard•kyverno-notation-aws-fips
< 1.1-r22
- chainguard•kyverno-reports-controller-1.14
< 1.14.4-r6
- chainguard•mattermost-10.12
< 0
- chainguard•mattermost-10.12-compat
< 0
- chainguard•mattermost-fips-10.12
< 10.12.0-r1
- chainguard•mattermost-fips-10.12-compat
< 10.12.0-r1
- chainguard•metricbeat-9.1
< 9.1.2-r3
- chainguard•metricbeat-9.1-oci-entrypoint
< 9.1.2-r3
Showing first 50 affected entries in server-rendered view.
References (11)
- https://access.redhat.com/security/cve/CVE-2025-11065
- https://bugzilla.redhat.com/show_bug.cgi?id=2391829
- https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c
- https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm
- https://nvd.nist.gov/vuln/detail/CVE-2025-11065
- https://github.com/go-viper/mapstructure
- https://pkg.go.dev/vuln/GO-2025-3900
- https://security-tracker.debian.org/tracker/CVE-2025-11065
- https://access.redhat.com/downloads/content/package-browser/
- https://github.com/go-viper/mapstructure/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11065.json