CVE-2025-11065: falha de média gravidade em github.com/go-viper/mapstructure/v2
Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
github.com/go-viper/mapstructure/v2Red Hat · OpenShift PipelinesRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2Red Hat · Red Hat Advanced Cluster Security 4Red Hat · Red Hat Certification for Red Hat Enterprise Linux 8Red Hat · Red Hat Certification Program for Red Hat Enterprise Linux 9Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat OpenShift AI (RHOAI)Red Hat · Red Hat OpenShift Container Platform 4Red Hat · Red Hat OpenShift Dev SpacesRed Hat · Red Hat OpenShift distributed tracing 3Red Hat · Red Hat OpenShift GitOpsRed Hat · Red Hat Trusted Application PipelineRed Hat · Red Hat Trusted Artifact SignerRed Hat · Zero Trust Workload Identity Manager - Tech PreviewCVEs relacionadas — github.com/go-viper/mapstructure/v2
No mesmo produto, das mais perigosas para as menos.
CVE-2024-1394HIGHGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsEPSS 1.5%CVE-2026-66786CRITICALSubmariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnetsEPSS 1.4%CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2026-16242CRITICALHypershift: konnectivity proxy-server accepts agent connections without validating client certificatesEPSS 0.9%CVE-2024-1139HIGHCluster-monitoring-operator: credentials leakEPSS 0.9%