CVE-2025-11065: 
Terraform Community vulnerability analysis and mitigation

CVE-2025-11065 is an information disclosure vulnerability in github.com/go-viper/mapstructure/v2, a popular Go library used for decoding generic map values into native Go structures. The flaw exists in the field processing component when using mapstructure.WeakDecode, where detailed error messages may leak sensitive input values (e.g., passwords, tokens, or secrets) into application logs when malformed data is processed. It affects all versions up to and including v2.3.0, with the fix introduced in v2.4.0. The vulnerability was reported on August 29, 2025, and the security advisory (GHSA-2464-8j7c-4cjm) was published on August 20, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-209 (Generation of Error Message Containing Sensitive Information). When mapstructure.WeakDecode processes user-supplied input that fails type conversion, internal Go standard library functions such as strconv.ParseInt, strconv.ParseUint, time.ParseDuration, url.Parse, and netip.ParseAddr return error messages that embed the original input value verbatim. These errors propagate up the call stack and are surfaced in application logs — for example, in OpenBao/HashiCorp Vault, a malformed ttl field value like "asdf" would appear in server error logs as time: invalid duration "asdf". The fix (commit 742921c) wraps all such error returns with sanitized error wrappers that strip the original input value from the error message (GitHub Commit, GitHub Advisory). Exploitation requires an attacker to submit malformed data to an application that uses WeakDecode in a security-critical context and that logs errors verbosely.

The primary impact is confidentiality loss — sensitive field values such as API tokens, passwords, or secrets submitted by users can be inadvertently written to application logs when type conversion fails. There is no integrity or availability impact. The scope is limited to applications that use mapstructure.WeakDecode (or related hooks) to process security-sensitive fields and that expose or store error logs in accessible locations. Downstream projects confirmed to be affected include OpenBao and HashiCorp Vault, where the SDK's FieldData.getPrimitive function passes raw user input through WeakDecode and surfaces errors in server logs (GitHub Advisory, Red Hat Bugzilla).

There is no known public exploit code or evidence of in-the-wild exploitation targeting this vulnerability. The EPSS score is approximately 0.011% (0.000110), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is passive in nature — an attacker submits malformed input to a vulnerable endpoint and then reads application logs (requiring some level of log access) to retrieve leaked values, making it a low-severity, opportunistic risk rather than an active attack vector (GitHub Advisory, Red Hat Bugzilla).

1. Identify a vulnerable target: Find an application using github.com/go-viper/mapstructure/v2 ≤ 2.3.0 that processes user-supplied input via mapstructure.WeakDecode in a security-critical context (e.g., OpenBao/Vault API endpoints).
2. Submit malformed input: Send a crafted API request with a malformed value for a sensitive field — for example, submitting a string like "asdf" for a field expected to be a duration or integer (e.g., {"ttl":"asdf"} to a Vault/OpenBao userpass endpoint).
3. Trigger error logging: The type conversion failure causes WeakDecode to generate an error message containing the original input value, which the application logs at ERROR level.
4. Access application logs: If the attacker has read access to server logs (via log aggregation systems, misconfigured log endpoints, or insider access), they can retrieve the leaked sensitive value from the error message (e.g., time: invalid duration "<secret_value>"). (GitHub Advisory)

• Logs: Application error logs containing messages such as time: invalid duration "<value>", strconv.ParseInt: parsing "<value>": invalid syntax, invalid URL: <value>, or similar Go standard library parse errors that include user-supplied input verbatim — particularly in Vault/OpenBao server logs at ERROR level.
• Logs: Repeated error log entries for the same field with varying input values, which may indicate an attacker probing the endpoint with different sensitive strings to confirm leakage.
• Network: Unusual or repeated API requests to authentication or configuration endpoints (e.g., /v1/auth/userpass/users/*) with malformed field values in the request body.

Upgrade github.com/go-viper/mapstructure/v2 to version 2.4.0 or later, which wraps all error-returning decode hooks to strip the original input value from error messages (GitHub Advisory, GitHub Commit). Downstream consumers such as OpenBao, HashiCorp Vault, Kubernetes, Grafana Alloy, and others should update their dependency and release patched versions. As a workaround where upgrading is not immediately possible, restrict access to application logs containing error output and avoid logging raw error messages from WeakDecode in security-critical code paths. Amazon Linux 2, Fedora, SUSE, and openSUSE have issued updated packages addressing this CVE (Red Hat Bugzilla).

The vulnerability was originally surfaced by researcher cipherboy in the context of OpenBao and HashiCorp Vault, noting it as a second iteration of a previously patched information disclosure issue (GHSA-fv92-fjc5-jj9h / HCSEC-2025-09). Red Hat tracked the issue under Bugzilla #2391829 with medium severity and coordinated fixes across a large number of dependent packages. Multiple Linux distributions including Fedora, SUSE, openSUSE, and Amazon Linux 2 issued security advisories and updated packages. The issue also affected downstream projects such as Kubernetes, Grafana Alloy, Trivy, cosign, hcloud, and CircleCI Server, reflecting the broad reach of the mapstructure library in the Go ecosystem (GitHub Advisory, Red Hat Bugzilla).