This vulnerability in mapstructure.WeakDecode of the go-viper mapstructure/v2 library allows information disclosure through error messages that may leak sensitive data. The flaw arises when malformed user input is processed, causing error messages to reveal sensitive input values. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact. The vendor advisory from Red Hat does not explicitly state patch availability or remediation details.

An attacker who can supply malformed input to the vulnerable component may receive error messages containing sensitive information. This could lead to unintended disclosure of confidential data processed by the application using this library. There is no indication of integrity or availability impact. The vulnerability requires user interaction and has a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2025-11065 for current remediation guidance. Until a fix is available, avoid processing untrusted input with the vulnerable mapstructure.WeakDecode function in security-critical contexts or implement additional input validation and error handling to prevent sensitive data leakage in error messages.