A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade amazon-cloudwatch-agentUpgrade nerdctl-debuginfoUpgrade nerdctl | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade amazon-cloudwatch-agentUpgrade nerdctl | Jan 27, 2026 | Jan 26, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Aug 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub