{"id":"CVE-2025-11065","aliases":["AZL-111596","AZL-75351","AZL-75369","AZL-75372","AZL-75375","AZL-75389","AZL-75402","AZL-75407","AZL-75410","AZL-75413","AZL-75416","AZL-75419","AZL-75425","AZL-75428","AZL-75434","AZL-75440","AZL-75449","AZL-75452","AZL-75458","AZL-75473","AZL-75476","AZL-75479","AZL-75488","AZL-75491","AZL-75497","AZL-75500","AZL-75524","AZL-75527","AZL-75530","AZL-75545","AZL-75548","AZL-75551","AZL-75554","AZL-75557","AZL-75560","AZL-75564","AZL-75573","AZL-75576","AZL-75579","AZL-75582","AZL-81197","DEBIAN-CVE-2025-11065","EUVD-2025-29426","GHSA-2464-8j7c-4cjm","GO-2025-3900","SUSE-SU-2025:21137-1","SUSE-SU-2025:4121-1","SUSE-SU-2025:4444-1","SUSE-SU-2025:4446-1","SUSE-SU-2025:4457-1","SUSE-SU-2025:4458-1","SUSE-SU-2025:4479-1","SUSE-SU-2025:4482-1","SUSE-SU-2026:0777-1","SUSE-SU-2026:20904-1","UBUNTU-CVE-2025-11065","openSUSE-SU-2025:15610-1","openSUSE-SU-2025:15631-1","openSUSE-SU-2025:15724-1","openSUSE-SU-2025:20073-1","openSUSE-SU-2025:20117-1","openSUSE-SU-2026:10232-1","openSUSE-SU-2026:20386-1","openSUSE-SU-2026:20654-1","openSUSE-SU-2026:20798-1"],"status":"published","title":"Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00519,"percentile":0.44378,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-117","CWE-209"],"published":"2025-08-21T14:37:19Z","modified":"2026-11-06T10:03:24Z","fixes":[{"ecosystem":"Go","package":"github.com/go-viper/mapstructure/v2","fixed_in":["2.4.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"cert-manager","fixed_in":["1.12.15-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"coredns","fixed_in":["1.11.4-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-buildx","fixed_in":["0.14.0-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-cli","fixed_in":["25.0.7-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-compose","fixed_in":["2.27.0-8"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"gh","fixed_in":["2.62.0-13"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cert-manager","fixed_in":["1.11.2-27"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"influxdb","fixed_in":["2.7.5-13"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers","fixed_in":["3.19.1.kata2-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"keda","fixed_in":["2.14.1-11"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubevirt","fixed_in":["1.7.0-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kured","fixed_in":["1.15.0-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cri-o","fixed_in":["1.22.3-20"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"opa","fixed_in":["0.63.0-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"packer","fixed_in":["1.9.5-13"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"influxdb","fixed_in":["2.6.1-30"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"keda","fixed_in":["2.4.0-32"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"kube-vip-cloud-provider","fixed_in":["0.0.2-26"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"kubevirt","fixed_in":["0.59.0-38"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"kured","fixed_in":["1.14.2-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"moby-buildx","fixed_in":["0.7.1-28"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"moby-cli","fixed_in":["24.0.9-8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"moby-compose","fixed_in":["2.17.3-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"opa","fixed_in":["0.63.0-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"skopeo","fixed_in":["1.14.4-8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"packer","fixed_in":["1.9.5-18"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"prometheus","fixed_in":["2.37.9-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"telegraf","fixed_in":["1.31.0-15"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"vitess","fixed_in":["19.0.4-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"skopeo","fixed_in":["1.14.2-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"telegraf","fixed_in":["1.29.4-21"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"terraform","fixed_in":["1.3.2-29"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"vitess","fixed_in":["17.0.7-14"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-go-viper-mapstructure","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"grafana","fixed_in":["11.6.6-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"trivy","fixed_in":["0.67.2-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/go-viper/mapstructure/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.0"},{"fixed":"2.4.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt-openvmm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.18.0-29"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.1-26"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"azl-otel-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.127.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.15-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.6.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.7-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-compose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.0-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-27"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1.kata2-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"keda","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.1-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kured","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-20"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"opa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-30"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"keda","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-32"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kube-vip-cloud-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.2-26"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.59.0-38"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kured","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"moby-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-28"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"moby-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"moby-compose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.3-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"opa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63.0-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-18"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.9-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.0.4-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.6.2-27"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.4-21"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"terraform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-29"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.7-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-preview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.27.0~preview2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-go-viper-mapstructure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-1","2.2.1-2","2.4.0-1","2.5.0-1","2.5.0-1~bpo13+1","2.5.0-2","2.5.0-3"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-go-viper-mapstructure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}],"versions":["2.2.1-1","2.2.1-2"]},{"source":"osv","ecosystem":"Go","package":"github.com/go-viper/mapstructure/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-viper/mapstructure","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-viper/mapstructure/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.3-150700.15.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"Multi-Linux-ManagerTools-SLE-release","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12-120002.1.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.10-120002.4.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.23-120002.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.10-150002.4.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.23-150002.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.23-150002.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-1.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.10-1.87.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3-1.30.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.6-21.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.14-38.162.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-6.36.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.37-1.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150000.1.62.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.10-150000.1.87.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3-150000.1.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.6-150000.3.49.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.14-150000.3.139.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-150000.3.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.37-150000.1.27.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150000.1.62.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.37-150000.1.27.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150000.1.62.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.14-150000.3.139.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-150000.3.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16.2-150400.3.104.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16.2-150400.3.148.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.10-150200.3.80.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.10-150200.3.80.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.10-150200.3.80.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150400.3.35.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150400.3.35.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-github-go-viper-mapstructure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-go-viper-mapstructure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.0-1","2.5.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-go-viper-mapstructure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-1","2.2.1-2","2.4.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.67.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-160000.1.1"}]}],"bundled":9}],"products":[{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2"},{"vendor":"red hat","product":"red hat advanced cluster security 4"},{"vendor":"red hat","product":"red hat certification for red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat certification program for red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift dev spaces"},{"vendor":"red hat","product":"red hat openshift distributed tracing 3"},{"vendor":"red hat","product":"red hat openshift gitops"},{"vendor":"red hat","product":"red hat trusted application pipeline"},{"vendor":"red hat","product":"red hat trusted artifact signer"},{"vendor":"red hat","product":"zero trust workload identity manager - tech preview"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-11065","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2391829","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c","tags":["fix","web","report"]},{"url":"https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm","tags":["exploit","advisory","web","report"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3900","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11065","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2464-8j7c-4cjm"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/go-viper/mapstructure/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11065.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-11065","tags":["advisory"]},{"url":"https://github.com/go-viper/mapstructure","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521137-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248960","tags":["report"]},{"url":"https://bugzilla.suse.com/1250621","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254121-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254444-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249434","tags":["report"]},{"url":"https://bugzilla.suse.com/1250616","tags":["report"]},{"url":"https://bugzilla.suse.com/1251454","tags":["report"]},{"url":"https://bugzilla.suse.com/1251657","tags":["report"]},{"url":"https://bugzilla.suse.com/1254113","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64751","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254446-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254457-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227577","tags":["report"]},{"url":"https://bugzilla.suse.com/1227579","tags":["report"]},{"url":"https://bugzilla.suse.com/1243611","tags":["report"]},{"url":"https://bugzilla.suse.com/1243704","tags":["report"]},{"url":"https://bugzilla.suse.com/1244027","tags":["report"]},{"url":"https://bugzilla.suse.com/1244127","tags":["report"]},{"url":"https://bugzilla.suse.com/1244534","tags":["report"]},{"url":"https://bugzilla.suse.com/1245099","tags":["report"]},{"url":"https://bugzilla.suse.com/1245302","tags":["report"]},{"url":"https://bugzilla.suse.com/1246068","tags":["report"]},{"url":"https://bugzilla.suse.com/1246320","tags":["report"]},{"url":"https://bugzilla.suse.com/1246553","tags":["report"]},{"url":"https://bugzilla.suse.com/1246586","tags":["report"]},{"url":"https://bugzilla.suse.com/1246662","tags":["report"]},{"url":"https://bugzilla.suse.com/1246735","tags":["report"]},{"url":"https://bugzilla.suse.com/1246736","tags":["report"]},{"url":"https://bugzilla.suse.com/1246738","tags":["report"]},{"url":"https://bugzilla.suse.com/1246789","tags":["report"]},{"url":"https://bugzilla.suse.com/1246882","tags":["report"]},{"url":"https://bugzilla.suse.com/1246906","tags":["report"]},{"url":"https://bugzilla.suse.com/1246925","tags":["report"]},{"url":"https://bugzilla.suse.com/1247688","tags":["report"]},{"url":"https://bugzilla.suse.com/1247721","tags":["report"]},{"url":"https://bugzilla.suse.com/1247748","tags":["report"]},{"url":"https://bugzilla.suse.com/1251044","tags":["report"]},{"url":"https://bugzilla.suse.com/1251138","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6197","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254458-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237495","tags":["report"]},{"url":"https://bugzilla.suse.com/1252100","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254479-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237060","tags":["report"]},{"url":"https://bugzilla.suse.com/1241455","tags":["report"]},{"url":"https://bugzilla.suse.com/1250911","tags":["report"]},{"url":"https://bugzilla.suse.com/1251864","tags":["report"]},{"url":"https://bugzilla.suse.com/1253024","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62349","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254482-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260777-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250620","tags":["report"]},{"url":"https://bugzilla.suse.com/1253913","tags":["report"]},{"url":"https://bugzilla.suse.com/1256496","tags":["report"]},{"url":"https://bugzilla.suse.com/1256562","tags":["report"]},{"url":"https://bugzilla.suse.com/1257080","tags":["report"]},{"url":"https://bugzilla.suse.com/1257085","tags":["report"]},{"url":"https://bugzilla.suse.com/1257139","tags":["report"]},{"url":"https://bugzilla.suse.com/1258542","tags":["report"]},{"url":"https://bugzilla.suse.com/1258612","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26958","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620904-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-11065","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11065","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227010","tags":["report"]},{"url":"https://bugzilla.suse.com/1232948","tags":["report"]},{"url":"https://bugzilla.suse.com/1234512","tags":["report"]},{"url":"https://bugzilla.suse.com/1235265","tags":["report"]},{"url":"https://bugzilla.suse.com/1237618","tags":["report"]},{"url":"https://bugzilla.suse.com/1239225","tags":["report"]},{"url":"https://bugzilla.suse.com/1239385","tags":["report"]},{"url":"https://bugzilla.suse.com/1240466","tags":["report"]},{"url":"https://bugzilla.suse.com/1241724","tags":["report"]},{"url":"https://bugzilla.suse.com/1243633","tags":["report"]},{"url":"https://bugzilla.suse.com/1246151","tags":["report"]},{"url":"https://bugzilla.suse.com/1246730","tags":["report"]},{"url":"https://bugzilla.suse.com/1248897","tags":["report"]},{"url":"https://bugzilla.suse.com/1248937","tags":["report"]},{"url":"https://bugzilla.suse.com/1250625","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://bugzilla.suse.com/1231844","tags":["report"]},{"url":"https://bugzilla.suse.com/1232975","tags":["report"]},{"url":"https://bugzilla.suse.com/1233343","tags":["report"]},{"url":"https://bugzilla.suse.com/1235206","tags":["report"]},{"url":"https://bugzilla.suse.com/1235574","tags":["report"]},{"url":"https://bugzilla.suse.com/1236510","tags":["report"]},{"url":"https://bugzilla.suse.com/1236559","tags":["report"]},{"url":"https://bugzilla.suse.com/1236734","tags":["report"]},{"url":"https://bugzilla.suse.com/1237671","tags":["report"]},{"url":"https://bugzilla.suse.com/1238703","tags":["report"]},{"url":"https://bugzilla.suse.com/1241683","tags":["report"]},{"url":"https://bugzilla.suse.com/1241687","tags":["report"]},{"url":"https://bugzilla.suse.com/1241809","tags":["report"]},{"url":"https://bugzilla.suse.com/1243672","tags":["report"]},{"url":"https://bugzilla.suse.com/1243714","tags":["report"]},{"url":"https://bugzilla.suse.com/1255340","tags":["report"]},{"url":"https://bugzilla.suse.com/1257337","tags":["report"]},{"url":"https://bugzilla.suse.com/1257349","tags":["report"]},{"url":"https://bugzilla.suse.com/1258136","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21722","tags":["web"]},{"url":"https://bugzilla.suse.com/1251363","tags":["report"]},{"url":"https://bugzilla.suse.com/1251547","tags":["report"]},{"url":"https://bugzilla.suse.com/1253512","tags":["report"]},{"url":"https://bugzilla.suse.com/1253786","tags":["report"]},{"url":"https://bugzilla.suse.com/1253977","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-11065","title":"Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T19:36:28.9Z","modified":"2026-11-05T14:47:08.47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-209"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2025-29426","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T19:36:28Z","modified":"2026-11-05T14:47:08Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T16:59:57.067043Z"}],"ghsa":[{"id":"GHSA-2464-8j7c-4cjm","title":"go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data","description":"### Summary\n\nUse of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.\n\n### Details\n\nOpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows:\n\nhttps://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50\n\n```go\n\t\t\t_, _, err := d.getPrimitive(field, schema)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error converting input for field %q: %w\", field, err)\n\t\t\t}\n```\n\nwhere this calls `mapstructure.WeakDecode(...)`: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193\n\n```go\n\nfunc (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {\n\traw, ok := d.Raw[k]\n\tif !ok {\n\t\treturn nil, false, nil\n\t}\n\n\tswitch t := schema.Type; t {\n\tcase TypeBool:\n\t\tvar result bool\n\t\tif err := mapstructure.WeakDecode(raw, \u0026result); err != nil {\n\t\t\treturn nil, false, err\n\t\t}\n\t\treturn result, true, nil\n```\n\nNotably, `WeakDecode(...)` eventually calls one of the decode helpers, which surfaces the original value via `strconv` helpers:\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L720-L727\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L791-L798\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/decode_hooks.go#L180\n\n\u0026 more. These are different code paths than are fixed in the previous iteration at https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h.\n\n### PoC\n\nTo reproduce with OpenBao:\n\n```\n$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300\n```\n\nand in a new tab:\n\n```\n$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass\nSuccess! Enabled userpass auth method at: userpass/\n$ curl -X PUT -H \"X-Vault-Request: true\" -H \"X-Vault-Token: root\" -d '{\"ttl\":\"asdf\"}' \"http://localhost:8200/v1/auth/userpass/users/asdf\"\n\n--\u003e server logs:\n\n2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error=\"error converting input for field \\\"ttl\\\": time: invalid duration \\\"asdf\\\"\"\n```\n\n### Impact\n\nThis is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `'' expected a map, got 'string'` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided).\n\nThis was rated 4.5 Medium by HashiCorp in the past iteration.","status":"published","published":"2025-08-21T14:37:19Z","modified":"2026-01-27T21:01:24Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T14:39:20.563096Z"}],"nvd":[{"id":"CVE-2025-11065","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06.84Z","modified":"2026-11-05T15:17:07.947Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-209"],"updated_at":"2026-11-05T19:55:53.17268Z"}],"osv":[{"id":"CVE-2025-11065","title":"Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T19:36:28.9Z","modified":"2026-11-07T02:31:00.43865872Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-209"],"updated_at":"2026-11-07T03:07:55.264406Z"},{"id":"DEBIAN-CVE-2025-11065","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06.84Z","modified":"2026-11-06T10:03:24.139454245Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-06T10:38:30.18578Z"},{"id":"GHSA-2464-8j7c-4cjm","title":"go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data","description":"### Summary\n\nUse of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.\n\n### Details\n\nOpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows:\n\nhttps://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50\n\n```go\n\t\t\t_, _, err := d.getPrimitive(field, schema)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error converting input for field %q: %w\", field, err)\n\t\t\t}\n```\n\nwhere this calls `mapstructure.WeakDecode(...)`: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193\n\n```go\n\nfunc (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {\n\traw, ok := d.Raw[k]\n\tif !ok {\n\t\treturn nil, false, nil\n\t}\n\n\tswitch t := schema.Type; t {\n\tcase TypeBool:\n\t\tvar result bool\n\t\tif err := mapstructure.WeakDecode(raw, \u0026result); err != nil {\n\t\t\treturn nil, false, err\n\t\t}\n\t\treturn result, true, nil\n```\n\nNotably, `WeakDecode(...)` eventually calls one of the decode helpers, which surfaces the original value via `strconv` helpers:\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L720-L727\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L791-L798\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/decode_hooks.go#L180\n\n\u0026 more. These are different code paths than are fixed in the previous iteration at https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h.\n\n### PoC\n\nTo reproduce with OpenBao:\n\n```\n$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300\n```\n\nand in a new tab:\n\n```\n$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass\nSuccess! Enabled userpass auth method at: userpass/\n$ curl -X PUT -H \"X-Vault-Request: true\" -H \"X-Vault-Token: root\" -d '{\"ttl\":\"asdf\"}' \"http://localhost:8200/v1/auth/userpass/users/asdf\"\n\n--\u003e server logs:\n\n2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error=\"error converting input for field \\\"ttl\\\": time: invalid duration \\\"asdf\\\"\"\n```\n\n### Impact\n\nThis is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `'' expected a map, got 'string'` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided).\n\nThis was rated 4.5 Medium by HashiCorp in the past iteration.","status":"published","published":"2025-08-21T14:37:19Z","modified":"2026-09-10T03:50:26.445975424Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"UBUNTU-CVE-2025-11065","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:00Z","modified":"2026-10-17T12:56:46.782350722Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"AZL-111596","title":"CVE-2025-11065 affecting package kubevirt-openvmm 1.9.0-1","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-75351","title":"CVE-2025-11065 affecting package buildah 1.18.0-29","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:54.631124Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75369","title":"CVE-2025-11065 affecting package podman 4.1.1-26","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:54.899215Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75372","title":"CVE-2025-11065 affecting package azl-otel-collector 0.127.0-1","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75375","title":"CVE-2025-11065 affecting package cri-o 1.30.1-1","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75389","title":"CVE-2025-11065 affecting package cert-manager for versions less than 1.12.15-6","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75402","title":"CVE-2025-11065 affecting package podman 5.6.1-10","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75407","title":"CVE-2025-11065 affecting package coredns for versions less than 1.11.4-14","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75410","title":"CVE-2025-11065 affecting package docker-buildx for versions less than 0.14.0-10","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75413","title":"CVE-2025-11065 affecting package docker-cli for versions less than 25.0.7-2","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75416","title":"CVE-2025-11065 affecting package docker-compose for versions less than 2.27.0-8","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75419","title":"CVE-2025-11065 affecting package gh for versions less than 2.62.0-13","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-09-08T17:33:11Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75425","title":"CVE-2025-11065 affecting package cert-manager for versions less than 1.11.2-27","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:55.860293Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75428","title":"CVE-2025-11065 affecting package influxdb for versions less than 2.7.5-13","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75434","title":"CVE-2025-11065 affecting package kata-containers for versions less than 3.19.1.kata2-6","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75440","title":"CVE-2025-11065 affecting package keda for versions less than 2.14.1-11","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-10-31T15:02:25Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75449","title":"CVE-2025-11065 affecting package kubevirt for versions less than 1.7.0-3","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75452","title":"CVE-2025-11065 affecting package kured for versions less than 1.15.0-3","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75458","title":"CVE-2025-11065 affecting package cri-o for versions less than 1.22.3-20","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:56.930729Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75473","title":"CVE-2025-11065 affecting package opa for versions less than 0.63.0-3","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75476","title":"CVE-2025-11065 affecting package packer for versions less than 1.9.5-13","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75479","title":"CVE-2025-11065 affecting package influxdb for versions less than 2.6.1-30","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:57.23262Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75488","title":"CVE-2025-11065 affecting package keda for versions less than 2.4.0-32","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:57.456543Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75491","title":"CVE-2025-11065 affecting package kube-vip-cloud-provider for versions less than 0.0.2-26","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:57.526241Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75497","title":"CVE-2025-11065 affecting package kubevirt for versions less than 0.59.0-38","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:57.520481Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75500","title":"CVE-2025-11065 affecting package kured for versions less than 1.14.2-7","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:57.417657Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75524","title":"CVE-2025-11065 affecting package moby-buildx for versions less than 0.7.1-28","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:57.233939Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75527","title":"CVE-2025-11065 affecting package moby-cli for versions less than 24.0.9-8","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:57.435368Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75530","title":"CVE-2025-11065 affecting package moby-compose for versions less than 2.17.3-14","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:57.723971Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75545","title":"CVE-2025-11065 affecting package opa for versions less than 0.63.0-6","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:58.362435Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75548","title":"CVE-2025-11065 affecting package skopeo for versions less than 1.14.4-8","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75551","title":"CVE-2025-11065 affecting package packer for versions less than 1.9.5-18","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:58.375444Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75554","title":"CVE-2025-11065 affecting package prometheus for versions less than 2.37.9-7","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:58.208668Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75557","title":"CVE-2025-11065 affecting package telegraf for versions less than 1.31.0-15","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75560","title":"CVE-2025-11065 affecting package vitess for versions less than 19.0.4-9","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75564","title":"CVE-2025-11065 affecting package rook 1.6.2-27","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:58.33763Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75573","title":"CVE-2025-11065 affecting package skopeo for versions less than 1.14.2-14","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:58.413234Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75576","title":"CVE-2025-11065 affecting package telegraf for versions less than 1.29.4-21","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:58.60639Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75579","title":"CVE-2025-11065 affecting package terraform for versions less than 1.3.2-29","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:58.602961Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75582","title":"CVE-2025-11065 affecting package vitess for versions less than 17.0.7-14","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-04-21T04:38:58.74849Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-81197","title":"CVE-2025-11065 affecting package kata-containers-preview 3.27.0~preview2-2","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","status":"published","published":"2026-01-26T20:16:06Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"GO-2025-3900","title":"Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure","description":"Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure","status":"published","published":"2025-08-29T14:52:35Z","modified":"2026-08-07T08:11:50.208061222Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15610-1","title":"grafana-11.6.6-1.1 on GA media","description":"These are all security issues fixed in the grafana-11.6.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-08T00:00:00Z","modified":"2026-03-23T04:54:00.093939Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15631-1","title":"alloy-1.11.2-2.1 on GA media","description":"These are all security issues fixed in the alloy-1.11.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-14T00:00:00Z","modified":"2026-03-23T04:54:01.705502Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15724-1","title":"trivy-0.67.2-1.1 on GA media","description":"These are all security issues fixed in the trivy-0.67.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-10T00:00:00Z","modified":"2026-03-23T04:54:08.409812Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:20073-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\n- CVE-2025-58058: Removed dependency on vulnerable github.com/ulikunitz/xz (bsc#1248960).\n- CVE-2025-11065: Fixed sensitive information leak in logs (bsc#1250621).\n","status":"published","published":"2025-11-20T17:26:16Z","modified":"2026-03-23T04:54:16.428452Z","updated_at":"2026-11-02T16:58:38.101535Z"}]},"sources_more":{"osv":15}}