EUVD-2026-42938
GHSA-h69g-9hx6-f3v4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, low-complexity, unauthenticated parsing of an attacker file with no user interaction; impact is availability-only (OOM/panic) with no confidentiality or integrity loss.
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/v2 uses an attacker-controlled <row r="N"> XML attribute value directly as the length argument to make([]xlsxRow, row) without validating it against the Excel row limit (TotalRows = 1,048,576). A specially crafted XLSX file can trigger two denial-of-service variants: (A) an out-of-memory process kill when r=2147483647 forces a ~16 GB allocation attempt, and (B) a runtime panic via out-of-bounds slice indexing when r=-1. Any service that opens attacker-supplied XLSX files and calls GetCellValue is affected. No authentication is required. This issue is fixed in version 2.11.0.
AnalysisAI
Denial of service in the Excelize Go library (github.com/xuri/excelize/v2, a.k.a. qax-os/excelize) before 2.11.0 allows remote attackers to crash any service that opens attacker-supplied XLSX files and reads cell values. The checkSheet() function trusts the <row r="N"> XML attribute as an allocation length, enabling either a ~16 GB out-of-memory kill (r=2147483647) or a runtime panic from negative-index slicing (r=-1). No authentication is required; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Excelize is a widely used pure-Go library for reading and writing Microsoft Excel (OOXML/XLSX) spreadsheets. XLSX files are ZIP archives of XML worksheet parts in which each <row> element carries an r attribute indicating its 1-based row index. During parsing, checkSheet() passes this attacker-controlled r value directly into make([]xlsxRow, row) to pre-size the row slice, without bounding it against Excel's documented maximum of TotalRows = 1,048,576 or rejecting negative values. This is a textbook CWE-770 (Allocation of Resources Without Limits or Throttling): an untrusted numeric field from the input governs a memory allocation. A large positive r drives an enormous slice allocation (Go's make computes size = row * sizeof(xlsxRow)), while a negative r that survives as an int leads to out-of-bounds indexing and a panic. The affected code path is reached through common APIs such as GetCellValue, so ordinary read workflows trigger it.
RemediationAI
Primary fix: upgrade the Excelize dependency to version 2.11.0 or later - Vendor-released patch: v2.11.0 - for example run 'go get github.com/xuri/excelize/v2@v2.11.0' and rebuild, per the release at https://github.com/qax-os/excelize/releases/tag/v2.11.0 and advisory https://github.com/qax-os/excelize/security/advisories/GHSA-h69g-9hx6-f3v4. If you cannot upgrade immediately, apply compensating controls at the ingestion boundary: enforce a strict memory cap on the parsing process (Go's GOMEMLIMIT or a container memory limit with a supervisor that restarts on OOM) so a single crafted file cannot exhaust host memory, and run the parser in an isolated worker/sandbox so a panic or OOM kill does not take down the main service (trade-off: added operational complexity and per-request overhead). You can also pre-screen uploads by unzipping the XLSX and rejecting worksheet XML whose <row r="..."> values are negative or exceed 1,048,576 before handing the file to Excelize (trade-off: custom validation code that must track the OOXML schema). Recover from panics with defer/recover around parsing calls to contain variant B, but note this does not stop the variant A memory-exhaustion kill, which is why the memory limit is essential.
Uncontrolled memory and CPU consumption in Excelize (qax-os/excelize), the widely used Go library for reading and writin
Panic-triggering denial of service in the Excelize Go library (all versions prior to 2.11.0) allows any actor who can su
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today