go-viper github.com/go-viper/mapstructure/v2 vulnerabilities

Latest go-viper github.com/go-viper/mapstructure/v2 CVEs

Newest publication first

1. CVE-2025-11065 Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

   Published 2026-01-26

   Medium·CVSS 5.3 EPSS 0.52%

   A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data process...

2. GHSA-fv92-fjc5-jj9h mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data

   Published 2025-06-27

   Medium·CVSS 5.3

   Summary Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields. Details OpenBao (and presumably HashiCorp Vault) have surfaced error messages from mapstructure as follows: https://github.com/openbao/open...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.