Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Docker‑Compose may leak sensitive data via error messages
published 9 months ago
Summary
Versions of Docker‑Compose before 2.27.0‑8 can expose private information when they encounter malformed input. The software can return detailed error messages that reveal the data being processed, which could be exploited in security‑critical situations. Upgrade Docker‑Compose to the latest version or apply any available patches to stop the data leakage.
What to do
- Update azure docker-compose to version 2.27.0-8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | docker-compose |
< 2.27.0-8 Fix: upgrade to 2.27.0-8
|
Original advisory text
CVE-2025-11065 affecting package docker-compose for versions less than 2.27.0-8
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
References
Timeline
Published26 Jan 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-75416 · OSV
Track software like this
Free during beta