CVE-2025-11065 go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data
Attackers can leak sensitive input values via detailed error messages in the Go mapstructure library when processing malformed data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-11065?
CVE-2025-11065 is a medium-severity vulnerability in Red Hat OpenShift Pipelines, published on 26 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
Weakness: CWE-209
Which versions are affected by CVE-2025-11065?
4 open source packages ship an affected version, including github.com/go-viper/mapstructure/v2 and github.com/go-viper/mapstructure.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-viper/mapstructure/v2 Go | All versions | 2.4.0 |
github.com/go-viper/mapstructure/v2 Go | All versions | 2.4.0 |
github.com/go-viper/mapstructure/v2 Go | All versions | 2.4.0 |
github.com/go-viper/mapstructure Go | All versions | None |
Linux distribution packages (2)
grafana openSUSE:Tumbleweed | All versions | 11.6.6-1.1 |
trivy openSUSE:Tumbleweed | All versions | 0.67.2-1.1 |
How do I fix CVE-2025-11065?
Upgrade github.com/go-viper/mapstructure/v2 to 2.4.0 or later.
Is CVE-2025-11065 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11065 exists.
Sources
Also known as AZL-75351, AZL-75369, AZL-75372, AZL-75375, AZL-75389, AZL-75402 and 108 more.