GHSA-fv92-fjc5-jj9h

Medium

Published: —Translated: 16/08/2026(UTC)NVD NIST

Summary

Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields. OpenBao (and presumably HashiCorp Vault) have surfaced error messages from mapstructure.

Risk Assessment

This may lead to disclosure of sensitive data, posing a serious risk to information confidentiality.

Recommendation

Update the library to a patched version and avoid processing sensitive fields in a way that may expose error messages.

Other vulnerabilities in mapstructure

CVE-2025-11065Medium
A flaw in the mapstructure library for Go causes information disclosure through detailed error messages. The WeakDecode function may leak sensitive input values in error messages when processing malformed data.

Original NVD description (English source)

### Summary Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields. ### Details OpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows: https://github.com/openbao/openbao/bl