go-viper/mapstructure

go-viper/mapstructure

Releases26

Frequency3 months 2 weeks

Last Release 5 months ago

Stars471

Go library for decoding generic map values into native Go structures and vice versa.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-11065 ↗	Jan 26, 2026Monday, 26 January 2026, 20:16	5.3 MEDIUM	—
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
CVE-2025-52893 ↗	Jun 25, 2025Wednesday, 25 June 2025, 17:15	4.5 MEDIUM	—
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.