EUVD-2026-94527
GHSA-jw42-f3rr-4cc3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Untrusted XLSX parsed over network with no auth/interaction (AV:N/PR:N/UI:N/AC:L); only availability affected (C:N/I:N), rated A:H for attacker-controlled sustained CPU consumption though single-core impact borders A:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.
AnalysisAI
Denial of service in the Excelize Go library (versions 2.1.0 through 2.11.0) allows an attacker-controlled spreadsheet to pin a CPU core for an arbitrary duration when a Go application calls File.GetRows or iterates Rows.Next/Rows.Columns on the untrusted file. The bug is an inconsistency in the row-number limit: Rows.Next enforces the TotalRows (1,048,576) cap, but Rows.Columns consumes the 'r' attribute of a crafted <row> element located after an ordinary valid row without that cap, so the iterator walks every missing row number instead of rejecting the workbook. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the application to invoke File.GetRows or iterate via Rows.Next/Rows.Columns (Excelize 2.1.0 through 2.11.0) on an attacker-supplied XLSX whose worksheet XML contains a <row> element with an 'r' attribute greater than TotalRows (1048576) positioned AFTER an ordinary valid row - that specific ordering bypasses the limit Rows.Next would otherwise enforce. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded denial-of-service issue (CWE-770, uncontrolled resource consumption). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version was available at the time of this review; the state of remediation is 'Upstream fix available (PR/commit); released patched version not independently confirmed.' Apply the upstream fix from PR #2438 / commit 01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23 - it adds a rows.err short-circuit in Rows.Next and returns ErrMaxRows when Rows.Columns reads an 'r' attribute greater than TotalRows - by upgrading to a release that contains it, vendoring the commit, or using a Go module replace directive until a tagged version ships (trade-off: tracking an unreleased commit means manual update tracking). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Go services and SBOMs for github.com/xuri/excelize/v2 at versions 2.1.0 through 2.11.0, prioritizing any endpoint, batch job, or backend worker that accepts or processes externally supplied XLSX files, and apply immediate throttling - per-request CPU and wall-clock timeouts, file-size and concurrency limits, and isolated processing workers - with alerting on anomalous CPU spikes on upload paths; if an affected service is internet-facing and cannot be constrained, temporarily disable XLSX parsing or gate it behind manual review. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Host header injection in Nezha 2.2.3's OAuth2 redirect endpoint (/api/v1/oauth2/{provider}) allows an unauthenticated re
Session cross-wiring in SUSE NeuVector before 5.6.1 allows an unauthenticated remote attacker to obtain another user's a
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today