5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-86rf-68f4-2cph

GHSA-86rf-68f4-2cph: Duplicate Advisory: go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-2464-8j7c-4cjm. This link is maintained to preserve external references.

Original Description

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-86rf-68f4-2cph

GHSA-86rf-68f4-2cph:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/go-viper/mapstructure/v2	go	< 2.4.0	2.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the error handling of go-viper/mapstructure's decoding functions. When the library attempts to convert a string from user-supplied data into a more specific type (e.g., integer, time, IP address, boolean), and fails due to malformed input, it generates an error message that includes the original, potentially sensitive, input string. If an application logs these errors, it can inadvertently leak sensitive information into its logs.

The security patch addresses this by introducing custom error wrappers. These wrappers intercept the original errors from Go's standard library parsing functions (like strconv.ParseInt, time.Parse, net.ParseIP, etc.) and generate a new, sanitized error message that omits the problematic input value. The patch modifies numerous DecodeHookFunc functions in decode_hooks.go and internal decode* methods in mapstructure.go to use these new error wrappers.

Any application using mapstructure to decode untrusted data into structs containing types like int, float, bool, time.Duration, net.IP, etc., is affected. An attacker can trigger the vulnerability by providing a malformed string for one of these fields, causing the application to log an error containing the attacker-controlled (and potentially sensitive) string.

Vulnerable functions

StringToTimeDurationHookFunc

decode_hooks.go

The function's returned anonymous function directly returned an error from `time.ParseDuration` which could leak the input data in the error message. The patch wraps the error to prevent this.

StringToURLHookFunc

decode_hooks.go

The function's returned anonymous function directly returned an error from `url.Parse` which could leak the input data in the error message. The patch wraps the error to prevent this.

StringToIPHookFunc

decode_hooks.go

The function's returned anonymous function included the raw input data in a formatted error string, leading to information disclosure. The patch removes the input data from the error message.

StringToIPNetHookFunc

decode_hooks.go

The function's returned anonymous function directly returned an error from `net.ParseCIDR` which could leak the input data in the error message. The patch wraps the error to prevent this.

StringToTimeHookFunc

decode_hooks.go

The function's returned anonymous function directly returned an error from `time.Parse` which could leak the input data in the error message. The patch wraps the error to prevent this.

StringToIntHookFunc

decode_hooks.go

The function's returned anonymous function directly returned an error from `strconv.ParseInt` which includes the invalid input in the error message. This applies to all `StringToInt*` and `StringToUint*` hook functions. The patch wraps the error to prevent this.

StringToFloat64HookFunc

decode_hooks.go

The function's returned anonymous function directly returned an error from `strconv.ParseFloat` which includes the invalid input in the error message. This applies to all `StringToFloat*` hook functions. The patch wraps the error to prevent this.

Decoder.decodeInt

mapstructure.go

When decoding a string to an integer, this function would return a `ParseError` containing the original error from `strconv.ParseInt`, which includes the sensitive input value. The patch wraps the error to sanitize it.

Decoder.decodeUint

mapstructure.go

When decoding a string to an unsigned integer, this function would return a `ParseError` containing the original error from `strconv.ParseUint`, which includes the sensitive input value. The patch wraps the error to sanitize it.

Decoder.decodeFloat

mapstructure.go

When decoding a string to a float, this function would return a `ParseError` containing the original error from `strconv.ParseFloat`, which includes the sensitive input value. The patch wraps the error to sanitize it.

Decoder.decodeBool

mapstructure.go

When decoding a string to a boolean, this function would return a `ParseError` containing the original error from `strconv.ParseBool`, which includes the sensitive input value. The patch wraps the error to sanitize it.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.3

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-86rf-68f4-2cph: Duplicate Advisory: go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data

Duplicate Advisory

Original Description

GHSA-86rf-68f4-2cph:

5.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

5.3

5.3

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

GHSA-86rf-68f4-2cph: Duplicate Advisory: go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data

Duplicate Advisory

Original Description

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI