CVE-2025-11065

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

• Published Jan 26, 2026
• CVSS 5.3 medium
• 0.4% chance of exploitation in the next 30 days (EPSS)
• A fix is available

CVE-2025-11065 at the National Vulnerability Database