CVE-2025-11065: Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-26 · updated 2026-06-30
Weakness: CWE-209

Description

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

Affected products

Red Hat Advanced Cluster Management for Kubernetes 2: all versions
Red Hat OpenShift Container Platform 4.18: all versions
Red Hat OpenShift Pipelines: all versions
Red Hat Advanced Cluster Security 4: all versions
Red Hat Certification for Red Hat Enterprise Linux 8: all versions
Red Hat Certification Program for Red Hat Enterprise Linux 9: all versions
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 9: all versions
Red Hat OpenShift AI (RHOAI): all versions
Red Hat OpenShift Dev Spaces: all versions
Red Hat OpenShift distributed tracing 3: all versions
Red Hat OpenShift GitOps: all versions
Red Hat Trusted Application Pipeline: all versions
Red Hat Trusted Artifact Signer: all versions
Red Hat Zero Trust Workload Identity Manager - Tech Preview: all versions

References

Get alerted when CVE-2025-11065 or the next vulnerability affects your stack