CVE-2025-11065
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Jan 26, 2026
CISA due date
—
The record
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/go-viper/mapstructure | 0 | No fix |
| Go | github.com/go-viper/mapstructure/v2 | 0 | 2.4.0 |
| Chainguard | auditbeat-9.1 | 0 | 9.1.2-r3 |
| Chainguard | auditbeat-9.1-oci-entrypoint | 0 | 9.1.2-r3 |
| Chainguard | auditbeat-fips-9 | 0 | 9.1.2-r1 |
| Chainguard | auditbeat-fips-9.1 | 0 | 9.1.2-r3 |
| Chainguard | bank-vaults | 0 | 1.32.0-r1 |
| Chainguard | bank-vaults-template | 0 | 1.32.0-r1 |
| Chainguard | beats-9.1 | 0 | 9.1.2-r3 |
| Chainguard | beats-fips-9 | 0 | 9.1.2-r1 |
| Chainguard | beats-fips-9.1 | 0 | 9.1.2-r3 |
| Chainguard | boring-registry-fips | 0 | 0.16.4-r5 |
| Chainguard | crossplane-crank-fips | 0 | 2.0.2-r2 |
| Chainguard | crossplane-fips | 0 | 2.0.2-r2 |
| Chainguard | datadog-agent-core-integrations-fips | 0 | 7.69.3-r1 |
| Chainguard | datadog-agent-fakeintake-fips | 0 | 7.69.3-r1 |
| Chainguard | datadog-agent-fips | 0 | 7.69.3-r1 |
| Chainguard | datadog-agent-jmx-fips | 0 | 7.69.3-r1 |
| Chainguard | datadog-agent-oci-compat-fips | 0 | 7.69.3-r1 |
| Chainguard | datadog-agent-s6-overlay-fips | 0 | 7.69.3-r1 |
| Chainguard | datadog-cluster-agent | 0 | 7.69.3-r1 |
| Chainguard | datadog-cluster-agent-fips | 0 | 7.69.3-r1 |
| Chainguard | datadog-cluster-agent-oci-compat | 0 | 7.69.3-r1 |
| Chainguard | datadog-cluster-agent-oci-compat-fips | 0 | 7.69.3-r1 |
| Chainguard | docker-compose-fips | 0 | 2.39.2-r1 |
| Chainguard | elastic-agent-fips | 0 | 9.1.2-r2 |
| Chainguard | filebeat-9.1 | 0 | 9.1.2-r3 |
| Chainguard | filebeat-9.1-oci-entrypoint | 0 | 9.1.2-r3 |
| Chainguard | filebeat-fips-9 | 0 | 9.1.2-r1 |
| Chainguard | filebeat-fips-9.1 | 0 | 9.1.2-r3 |
| Chainguard | gitaly-config-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-base-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-base-fips-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-certificates-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-cfssl-self-sign-scripts-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-cng-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-cng-fips-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-container-registry-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-container-registry-fips-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-container-registry-scripts-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-docker-machine-18.4 | 0 | 18.4.0-r1 |
| Chainguard | gitlab-docker-machine-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-docker-machine-fips-18.3 | 0 | 18.3.0-r1 |
| Chainguard | gitlab-docker-machine-fips-18.4 | 0 | 18.4.0-r1 |
| Chainguard | gitlab-docker-machine-fips-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-exporter-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-exporter-scripts-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-gitaly-scripts-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-logger-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-logger-compat-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-logger-fips-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-pages-scripts-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-rails-scripts-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-rails-scripts-fips-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-runner-18.4 | 0 | 18.4.0-r1 |
| Chainguard | gitlab-runner-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-fips-18.3 | 0 | 18.3.0-r1 |
| Chainguard | gitlab-runner-fips-18.4 | 0 | 18.4.0-r1 |
| Chainguard | gitlab-runner-fips-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-helper-18.4 | 0 | 18.4.0-r1 |
| Chainguard | gitlab-runner-helper-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-helper-compat-18.4 | 0 | 18.4.0-r1 |
| Chainguard | gitlab-runner-helper-compat-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-helper-compat-fips-18.3 | 0 | 18.3.0-r1 |
| Chainguard | gitlab-runner-helper-compat-fips-18.4 | 0 | 18.4.0-r1 |
| Chainguard | gitlab-runner-helper-compat-fips-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-helper-fips-18.3 | 0 | 18.3.0-r1 |
| Chainguard | gitlab-runner-helper-fips-18.4 | 0 | 18.4.0-r1 |
| Chainguard | gitlab-runner-helper-fips-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-18.4 | 0 | 18.4.0-r1 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-fips-18.3 | 0 | 18.3.0-r1 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-fips-18.4 | 0 | 18.4.0-r1 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-fips-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-oci-entrypoint-18.4 | 0 | 18.4.0-r1 |
| Chainguard | gitlab-runner-oci-entrypoint-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-oci-entrypoint-fips-18.3 | 0 | 18.3.0-r1 |
| Chainguard | gitlab-runner-oci-entrypoint-fips-18.4 | 0 | 18.4.0-r1 |
| Chainguard | gitlab-runner-oci-entrypoint-fips-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-shell-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-shell-fips-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-shell-scripts-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-shell-scripts-compat-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-sidekiq-ce-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-sidekiq-ce-fips-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-toolbox-ce-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-toolbox-ce-fips-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-webservice-ce-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-webservice-ce-fips-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-workhorse-scripts-18.3 | 0 | 18.3.1-r0 |
| Chainguard | gitlab-workhorse-scripts-fips-18.3 | 0 | 18.3.1-r0 |
| Chainguard | grafana-11.2 | 0 | 11.2.10.01-r5 |
| Chainguard | grafana-11.2-oci-compat | 0 | 11.2.10.01-r5 |
| Chainguard | grafana-11.3 | 0 | 11.3.9-r3 |
| Chainguard | grafana-11.3-oci-compat | 0 | 11.3.9-r3 |
| Chainguard | grafana-11.5 | 0 | 11.5.8-r1 |
| Chainguard | grafana-11.5-oci-compat | 0 | 11.5.8-r1 |
| Chainguard | grafana-11.6 | 0 | 11.6.5-r1 |
| Chainguard | grafana-11.6-oci-compat | 0 | 11.6.5-r1 |
| Chainguard | grafana-fips-11.6 | 0 | 11.6.5-r1 |
| Chainguard | grafana-fips-11.6-oci-compat | 0 | 11.6.5-r1 |
| Chainguard | grafana-fips-12.1 | 0 | 12.1.1-r1 |
| Chainguard | grafana-fips-12.1-oci-compat | 0 | 12.1.1-r1 |
| Chainguard | grafana-mimir-fips | 0 | 2.17.0-r1 |
| Chainguard | grafana-oci-compat | 0 | 11.2.10.01-r5 |
| Chainguard | heartbeat-9.1 | 0 | 9.1.2-r3 |
| Chainguard | heartbeat-9.1-oci-entrypoint | 0 | 9.1.2-r3 |
| Chainguard | heartbeat-fips-9 | 0 | 9.1.2-r1 |
| Chainguard | heartbeat-fips-9-oci-entrypoint | 0 | 9.1.2-r1 |
| Chainguard | heartbeat-fips-9.1 | 0 | 9.1.2-r3 |
| Chainguard | heartbeat-fips-9.1-oci-entrypoint | 0 | 9.1.2-r3 |
| Chainguard | istio-cni-fips-1.27 | 0 | 1.27.0-r3 |
| Chainguard | istio-cni-fips-1.27-compat | 0 | 1.27.0-r3 |
| Chainguard | istio-fips-1.27 | 0 | 1.27.0-r3 |
| Chainguard | istio-install-cni-fips-1.27 | 0 | 1.27.0-r3 |
| Chainguard | istio-install-cni-fips-1.27-compat | 0 | 1.27.0-r3 |
| Chainguard | istio-pilot-agent-fips-1.27 | 0 | 1.27.0-r3 |
| Chainguard | istio-pilot-agent-fips-1.27-compat | 0 | 1.27.0-r3 |
| Chainguard | istio-pilot-discovery-fips-1.27 | 0 | 1.27.0-r3 |
| Chainguard | jitsucom-bulker | 0 | 2.11.0-r2 |
| Chainguard | jitsucom-bulker-bulker | 0 | 2.11.0-r2 |
| Chainguard | jitsucom-bulker-bulker-compat | 0 | 2.11.0-r2 |
| Chainguard | jitsucom-bulker-ingest | 0 | 2.11.0-r2 |
| Chainguard | jitsucom-bulker-ingest-compat | 0 | 2.11.0-r2 |
| Chainguard | jitsucom-bulker-ingmgr | 0 | 2.11.0-r2 |
| Chainguard | jitsucom-bulker-ingmgr-compat | 0 | 2.11.0-r2 |
| Chainguard | jitsucom-bulker-sidecar | 0 | 2.11.0-r2 |
| Chainguard | jitsucom-bulker-sidecar-compat | 0 | 2.11.0-r2 |
| Chainguard | jitsucom-bulker-syncctl | 0 | 2.11.0-r2 |
| Chainguard | jitsucom-bulker-syncctl-compat | 0 | 2.11.0-r2 |
| Chainguard | k9s-fips | 0 | 0.50.9-r6 |
| Chainguard | kyverno-1.11 | 0 | 1.11.5-r27 |
| Chainguard | kyverno-1.14 | 0 | 1.14.4-r6 |
| Chainguard | kyverno-background-controller-1.11 | 0 | 1.11.5-r27 |
| Chainguard | kyverno-background-controller-1.14 | 0 | 1.14.4-r6 |
| Chainguard | kyverno-background-controller-fips-1.11 | 0 | 1.11.5-r35 |
| Chainguard | kyverno-background-controller-fips-1.12 | 0 | 1.12.7-r23 |
| Chainguard | kyverno-cleanup-controller-1.11 | 0 | 1.11.5-r27 |
| Chainguard | kyverno-cleanup-controller-1.14 | 0 | 1.14.4-r6 |
| Chainguard | kyverno-cleanup-controller-fips-1.11 | 0 | 1.11.5-r35 |
| Chainguard | kyverno-cleanup-controller-fips-1.12 | 0 | 1.12.7-r23 |
| Chainguard | kyverno-cli-1.11 | 0 | 1.11.5-r27 |
| Chainguard | kyverno-cli-1.14 | 0 | 1.14.4-r6 |
| Chainguard | kyverno-cli-fips-1.11 | 0 | 1.11.5-r35 |
| Chainguard | kyverno-cli-fips-1.12 | 0 | 1.12.7-r23 |
| Chainguard | kyverno-fips-1.11 | 0 | 1.11.5-r35 |
| Chainguard | kyverno-fips-1.12 | 0 | 1.12.7-r23 |
| Chainguard | kyverno-init-container-1.11 | 0 | 1.11.5-r27 |
| Chainguard | kyverno-init-container-1.14 | 0 | 1.14.4-r6 |
| Chainguard | kyverno-init-container-fips-1.11 | 0 | 1.11.5-r35 |
| Chainguard | kyverno-init-container-fips-1.12 | 0 | 1.12.7-r23 |
| Chainguard | kyverno-notation-aws-fips | 0 | 1.1-r22 |
| Chainguard | kyverno-reports-controller-1.11 | 0 | 1.11.5-r27 |
| Chainguard | kyverno-reports-controller-1.14 | 0 | 1.14.4-r6 |
| Chainguard | kyverno-reports-controller-fips-1.11 | 0 | 1.11.5-r35 |
| Chainguard | kyverno-reports-controller-fips-1.12 | 0 | 1.12.7-r23 |
| Chainguard | mattermost-10.12 | 0 | 0 |
| Chainguard | mattermost-10.12-compat | 0 | 0 |
| Chainguard | mattermost-fips-10.12 | 0 | 10.12.0-r1 |
| Chainguard | mattermost-fips-10.12-compat | 0 | 10.12.0-r1 |
| Chainguard | metricbeat-9.1 | 0 | 9.1.2-r3 |
| Chainguard | metricbeat-9.1-oci-entrypoint | 0 | 9.1.2-r3 |
| Chainguard | metricbeat-fips-9 | 0 | 9.1.2-r1 |
| Chainguard | metricbeat-fips-9.1 | 0 | 9.1.2-r3 |
| Chainguard | neuvector-sigstore-interface-fips | 0 | 0_git20250825-r0 |
| Chainguard | pluto-fips | 0 | 5.22.5-r1 |
| Chainguard | pluto-fips-compat | 0 | 5.22.5-r1 |
| Chainguard | rancher-security-scan-0.4 | 0 | 0.4.5-r2 |
| Chainguard | ratify-fips | 0 | 1.4.0-r5 |
| Chainguard | ratify-fips-compat | 0 | 1.4.0-r5 |
| Chainguard | ratify-fips-crds | 0 | 1.4.0-r5 |
| Chainguard | ratify-fips-licensechecker | 0 | 1.4.0-r5 |
| Chainguard | ratify-fips-licensechecker-compat | 0 | 1.4.0-r5 |
| Chainguard | ratify-fips-sbom | 0 | 1.4.0-r5 |
| Chainguard | ratify-fips-sbom-compat | 0 | 1.4.0-r5 |
| Chainguard | ratify-fips-schemavalidator | 0 | 1.4.0-r5 |
| Chainguard | ratify-fips-schemavalidator-compat | 0 | 1.4.0-r5 |
| Chainguard | ratify-fips-vulnerabilityreport | 0 | 1.4.0-r5 |
| Chainguard | ratify-fips-vulnerabilityreport-compat | 0 | 1.4.0-r5 |
| Chainguard | tfsec | 0 | 0 |
| Chainguard | tkn-fips | 0 | 0.42.0-r1 |
| Chainguard | zitadel-3 | 0 | 3.4.0-r0 |
| Chainguard | zitadel-3-compat | 0 | 3.4.0-r0 |
| Chainguard | zitadel-4 | 0 | 4.0.3-r0 |
| Chainguard | zitadel-4-compat | 0 | 4.0.3-r0 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | cosign | 0 | 3.0.5-150400.3.35.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | grafana | 0 | 11.5.10-150200.3.80.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | grafana | 0 | 11.5.10-150200.3.80.1 |
| SUSE:Manager Client Tools 15 | dracut-saltboot | 0 | 1.0.0-150000.1.62.1 |
| SUSE:Manager Client Tools 15 | grafana | 0 | 11.5.10-150000.1.87.1 |
| SUSE:Manager Client Tools 15 | mgr-push | 0 | 5.0.3-150000.1.30.1 |
| SUSE:Manager Client Tools 15 | rhnlib | 0 | 5.0.6-150000.3.49.1 |
| SUSE:Manager Client Tools 15 | spacecmd | 0 | 5.0.14-150000.3.139.1 |
| SUSE:Manager Client Tools 15 | supportutils-plugin-susemanager-client | 0 | 5.0.5-150000.3.30.1 |
| SUSE:Manager Client Tools 15 | uyuni-tools | 0 | 0.1.37-150000.1.27.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | dracut-saltboot | 0 | 1.0.0-150000.1.62.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | uyuni-tools | 0 | 0.1.37-150000.1.27.1 |
| Wolfi | bank-vaults | 0 | 1.32.0-r1 |
| Wolfi | bank-vaults-template | 0 | 1.32.0-r1 |
| Wolfi | datadog-cluster-agent | 0 | 7.69.3-r1 |
Related vulnerabilities
- GHSA-86rf-68f4-2cph Duplicate Advisory: go-viper's mapstructure May Leak Sensitive Information in Logs When… Also affects github.com/go-viper/mapstructure/v2
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects auditbeat-9.1
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects auditbeat-9.1
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects auditbeat-9.1
- CVE-2025-68119 Downloading and building modules with malicious version strings can cause local code… Also affects auditbeat-9.1
- CVE-2025-61731 Building a malicious file with cmd/go can cause can cause a write to an… Also affects auditbeat-9.1
- CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query. Also affects auditbeat-9.1
- CVE-2025-61728 archive/zip uses a super-linear file name indexing algorithm that is invoked the first… Also affects auditbeat-9.1