CVE catalog

CVE-2025-11065

Security update for cosign

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 25, 2026

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-go-viper-mapstructure132.2.1-1vulnerable
Debiangolang-github-go-viper-mapstructure132.2.1-2vulnerable
Debiangolang-github-go-viper-mapstructure132.4.0-1vulnerable
Debiangolang-github-go-viper-mapstructure132.5.0-1vulnerable
Debiangolang-github-go-viper-mapstructure132.5.0-1~bpo13+1vulnerable
Debiangolang-github-go-viper-mapstructure132.5.0-2vulnerable
Debiangolang-github-go-viper-mapstructure142.2.1-1vulnerable
Debiangolang-github-go-viper-mapstructure142.2.1-2vulnerable
Debiangolang-github-go-viper-mapstructure142.4.0-1fixed
Susecosignlinux enterprise server 16.03.0.5-160000.1.1fixed
Susecosignlinux enterprise server for sap applications 16.03.0.5-160000.1.1fixed
Opensusecosignleap 16.03.0.5-160000.1.1fixed
Opensusecosigntumbleweed3.0.4-2.1fixed
Opensusealloyleap 16.01.11.3-160000.1.1fixed
Opensusetrivytumbleweed0.67.2-1.1fixed
Opensusealloytumbleweed1.11.2-2.1fixed
Opensusegrafanatumbleweed11.6.6-1.1fixed
Susegolang-github-prometheus-alertmanagermanager client tools 120.28.1-1.34.1fixed
Susegrafanamanager client tools 1211.5.10-1.87.1fixed
Susemgr-pushmanager client tools 125.0.3-1.30.3fixed
Suserhnlibmanager client tools 125.0.6-21.55.1fixed
Susespacecmdmanager client tools 125.0.14-38.162.1fixed
Susesupportutils-plugin-susemanager-clientmanager client tools 125.0.5-6.36.1fixed
Suseuyuni-toolsmanager client tools 120.1.37-1.27.1fixed
SuseMulti-Linux-ManagerTools-SLE-releasemulti linux manager tools sle-1212-120002.1.11.1fixed
Susegrafanamulti linux manager tools sle-1211.5.10-120002.4.6.1fixed
Suseuyuni-toolsmulti linux manager tools sle-125.1.23-120002.3.6.1fixed
Susegrafanalinux enterprise module for package hub 15 sp611.5.10-150200.3.80.1fixed
Susegrafanalinux enterprise module for package hub 15 sp711.5.10-150200.3.80.1fixed
Opensusegrafanaleap 15.611.5.10-150200.3.80.1fixed
Susedracut-saltbootmanager client tools 151.0.0-150000.1.62.1fixed
Susegrafanamanager client tools 1511.5.10-150000.1.87.1fixed
Susemgr-pushmanager client tools 155.0.3-150000.1.30.1fixed
Suserhnlibmanager client tools 155.0.6-150000.3.49.1fixed
Susespacecmdmanager client tools 155.0.14-150000.3.139.1fixed
Susesupportutils-plugin-susemanager-clientmanager client tools 155.0.5-150000.3.30.1fixed
Suseuyuni-toolsmanager client tools 150.1.37-150000.1.27.1fixed
Susedracut-saltbootmanager client tools for sle micro 51.0.0-150000.1.62.1fixed
Suseuyuni-toolsmanager client tools for sle micro 50.1.37-150000.1.27.1fixed
Opensusedracut-saltbootleap 15.61.0.0-150000.1.62.1fixed
Opensusespacecmdleap 15.65.0.14-150000.3.139.1fixed
Opensusesupportutils-plugin-susemanager-clientleap 15.65.0.5-150000.3.30.1fixed
Susegrafanamulti linux manager tools sle-1511.5.10-150002.4.6.1fixed
Suseuyuni-toolsmulti linux manager tools sle-155.1.23-150002.3.6.1fixed
Suseuyuni-toolsmulti linux manager tools sle-micro-55.1.23-150002.3.6.1fixed
Susealloylinux enterprise server 16.01.11.3-160000.1.1fixed
Susealloylinux enterprise server for sap applications 16.01.11.3-160000.1.1fixed
Susealloylinux enterprise module for basesystem 15 sp71.11.3-150700.15.9.1fixed
Suserelease-notes-susemanager-proxymanager proxy lts 4.34.3.16.2-150400.3.104.2fixed
Suserelease-notes-susemanagermanager server lts 4.34.3.16.2-150400.3.148.1fixed
Susecosignlinux enterprise module for basesystem 15 sp73.0.5-150400.3.35.1fixed
Opensusecosignleap 15.63.0.5-150400.3.35.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-go-viper-mapstructuredeb142.4.0-1Not reportedDEBIAN-CVE-2025-11065Not reported
Susecosignrpmlinux enterprise server 16.03.0.5-160000.1.1Not reportedSUSE-SU-2026:20904-1Not reported
Susecosignrpmlinux enterprise server for sap applications 16.03.0.5-160000.1.1Not reportedSUSE-SU-2026:20904-1Not reported
Opensusecosignrpmleap 16.03.0.5-160000.1.1Not reportedOPENSUSE-SU-2026:20386-1Not reported
Opensusecosignrpmtumbleweed3.0.4-2.1Not reportedOPENSUSE-SU-2026:10232-1Not reported
Opensusealloyrpmleap 16.01.11.3-160000.1.1Not reportedOPENSUSE-SU-2025:20073-1Not reported
Opensusetrivyrpmtumbleweed0.67.2-1.1Not reportedOPENSUSE-SU-2025:15724-1Not reported
Opensusealloyrpmtumbleweed1.11.2-2.1Not reportedOPENSUSE-SU-2025:15631-1Not reported
Opensusegrafanarpmtumbleweed11.6.6-1.1Not reportedOPENSUSE-SU-2025:15610-1Not reported
Susegolang-github-prometheus-alertmanagerrpmmanager client tools 120.28.1-1.34.1Not reportedSUSE-SU-2025:4457-1Not reported
Susegrafanarpmmanager client tools 1211.5.10-1.87.1Not reportedSUSE-SU-2025:4457-1Not reported
Susemgr-pushrpmmanager client tools 125.0.3-1.30.3Not reportedSUSE-SU-2025:4457-1Not reported
Suserhnlibrpmmanager client tools 125.0.6-21.55.1Not reportedSUSE-SU-2025:4457-1Not reported
Susespacecmdrpmmanager client tools 125.0.14-38.162.1Not reportedSUSE-SU-2025:4457-1Not reported
Susesupportutils-plugin-susemanager-clientrpmmanager client tools 125.0.5-6.36.1Not reportedSUSE-SU-2025:4457-1Not reported
Suseuyuni-toolsrpmmanager client tools 120.1.37-1.27.1Not reportedSUSE-SU-2025:4457-1Not reported
SuseMulti-Linux-ManagerTools-SLE-releaserpmmulti linux manager tools sle-1212-120002.1.11.1Not reportedSUSE-SU-2025:4444-1Not reported
Susegrafanarpmmulti linux manager tools sle-1211.5.10-120002.4.6.1Not reportedSUSE-SU-2025:4444-1Not reported
Suseuyuni-toolsrpmmulti linux manager tools sle-125.1.23-120002.3.6.1Not reportedSUSE-SU-2025:4444-1Not reported
Susegrafanarpmlinux enterprise module for package hub 15 sp611.5.10-150200.3.80.1Not reportedSUSE-SU-2025:4482-1Not reported
Susegrafanarpmlinux enterprise module for package hub 15 sp711.5.10-150200.3.80.1Not reportedSUSE-SU-2025:4482-1Not reported
Opensusegrafanarpmleap 15.611.5.10-150200.3.80.1Not reportedSUSE-SU-2025:4482-1Not reported
Susedracut-saltbootrpmmanager client tools 151.0.0-150000.1.62.1Not reportedSUSE-SU-2025:4458-1Not reported
Susegrafanarpmmanager client tools 1511.5.10-150000.1.87.1Not reportedSUSE-SU-2025:4458-1Not reported
Susemgr-pushrpmmanager client tools 155.0.3-150000.1.30.1Not reportedSUSE-SU-2025:4458-1Not reported
Suserhnlibrpmmanager client tools 155.0.6-150000.3.49.1Not reportedSUSE-SU-2025:4458-1Not reported
Susespacecmdrpmmanager client tools 155.0.14-150000.3.139.1Not reportedSUSE-SU-2025:4458-1Not reported
Susesupportutils-plugin-susemanager-clientrpmmanager client tools 155.0.5-150000.3.30.1Not reportedSUSE-SU-2025:4458-1Not reported
Suseuyuni-toolsrpmmanager client tools 150.1.37-150000.1.27.1Not reportedSUSE-SU-2025:4458-1Not reported
Susedracut-saltbootrpmmanager client tools for sle micro 51.0.0-150000.1.62.1Not reportedSUSE-SU-2025:4458-1Not reported
Suseuyuni-toolsrpmmanager client tools for sle micro 50.1.37-150000.1.27.1Not reportedSUSE-SU-2025:4458-1Not reported
Opensusedracut-saltbootrpmleap 15.61.0.0-150000.1.62.1Not reportedSUSE-SU-2025:4458-1Not reported
Opensusespacecmdrpmleap 15.65.0.14-150000.3.139.1Not reportedSUSE-SU-2025:4458-1Not reported
Opensusesupportutils-plugin-susemanager-clientrpmleap 15.65.0.5-150000.3.30.1Not reportedSUSE-SU-2025:4458-1Not reported
Susegrafanarpmmulti linux manager tools sle-1511.5.10-150002.4.6.1Not reportedSUSE-SU-2025:4446-1Not reported
Suseuyuni-toolsrpmmulti linux manager tools sle-155.1.23-150002.3.6.1Not reportedSUSE-SU-2025:4446-1Not reported
Suseuyuni-toolsrpmmulti linux manager tools sle-micro-55.1.23-150002.3.6.1Not reportedSUSE-SU-2025:4446-1Not reported
Susealloyrpmlinux enterprise server 16.01.11.3-160000.1.1Not reportedSUSE-SU-2025:21137-1Not reported
Susealloyrpmlinux enterprise server for sap applications 16.01.11.3-160000.1.1Not reportedSUSE-SU-2025:21137-1Not reported
Susealloyrpmlinux enterprise module for basesystem 15 sp71.11.3-150700.15.9.1Not reportedSUSE-SU-2025:4121-1Not reported
Suserelease-notes-susemanager-proxyrpmmanager proxy lts 4.34.3.16.2-150400.3.104.2Not reportedSUSE-SU-2025:4479-1Not reported
Suserelease-notes-susemanagerrpmmanager server lts 4.34.3.16.2-150400.3.148.1Not reportedSUSE-SU-2025:4479-1Not reported
Susecosignrpmlinux enterprise module for basesystem 15 sp73.0.5-150400.3.35.1Not reportedSUSE-SU-2026:0777-1Not reported
Opensusecosignrpmleap 15.63.0.5-150400.3.35.1Not reportedSUSE-SU-2026:0777-1Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [golang-github-go-viper-mapstructure-dev]Affected

    Source package: [golang-github-go-viper-mapstructure]

    Details (4)

    • 2.2.1-1 · all · trixie

      Affected

      pypi · golang-github-go-viper-mapstructure · debian · 13

    • 2.2.1-1 · all · trixie

      Affected

      pypi · golang-github-go-viper-mapstructure · debian · 13

    • 2.5.0-1~bpo13+1 · all · trixie-backports

      Affected

      pypi · golang-github-go-viper-mapstructure · debian · 13

    • 2.5.0-1~bpo13+1 · all · trixie-backports

      Affected

      pypi · golang-github-go-viper-mapstructure · debian · 13

[openSUSE Tumbleweed]

  • [cosign-bash-completion]Unknown

    Source package: [cosign]

    Details (1)

    • 3.1.2-1.2 · noarch · tumbleweed

      Unknown · Fixed: 3.0.4-2.1

      Version impact unknown

      pypi · cosign · opensuse · tumbleweed

  • [cosign-fish-completion]Unknown

    Source package: [cosign]

    Details (1)

    • 3.1.2-1.2 · noarch · tumbleweed

      Unknown · Fixed: 3.0.4-2.1

      Version impact unknown

      pypi · cosign · opensuse · tumbleweed

  • [cosign-zsh-completion]Unknown

    Source package: [cosign]

    Details (1)

    • 3.1.2-1.2 · noarch · tumbleweed

      Unknown · Fixed: 3.0.4-2.1

      Version impact unknown

      pypi · cosign · opensuse · tumbleweed

  • [alloy]Fixed

    Source package: [alloy]

    Details (1)

    • 1.18.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.11.2-2.1

      pypi · alloy · opensuse · tumbleweed

  • [cosign]Fixed

    Source package: [cosign]

    Details (1)

    • 3.1.2-1.2 · x86_64 · tumbleweed

      Fixed · Fixed: 3.0.4-2.1

      pypi · cosign · opensuse · tumbleweed

  • [grafana]Fixed

    Source package: [grafana]

    Details (1)

    • 12.4.5-4.1 · x86_64 · tumbleweed

      Fixed · Fixed: 11.6.6-1.1

      pypi · grafana · opensuse · tumbleweed

  • [trivy]Fixed

    Source package: [trivy]

    Details (1)

    • 0.74.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 0.67.2-1.1

      pypi · trivy · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]