EUVD-2026-42936
GHSA-q5j5-6p94-4gwc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker controls only an untrusted input file (AV:N, PR:N, UI:N, AC:L) and impact is a pure resource-exhaustion DoS, so C:N/I:N with A:H and unchanged scope.
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.
AnalysisAI
Uncontrolled memory and CPU consumption in Excelize (qax-os/excelize), the widely used Go library for reading and writing Microsoft Excel spreadsheets, before version 2.11.0 lets a crafted XLSX file trigger a denial of service. The streaming worksheet reader behind the Rows and GetRows APIs fails to enforce the TotalRows (1,048,576) limit on the row 'r' attribute, so a tiny file declaring an out-of-range row index with no cell coordinate forces GetRows to allocate empty rows up to that attacker-chosen index. No public exploit identified at time of analysis, but the trigger is trivial to construct and the fix is confined to a single validation check.
Technical ContextAI
Excelize is a popular pure-Go library for programmatically parsing and generating XLSX (Office Open XML SpreadsheetML) workbooks. In that format rows are represented as <row r="N"> elements, where N is a 1-based index; the specification caps a worksheet at 1,048,576 rows (the library's TotalRows constant). The vulnerability is a CWE-400 Uncontrolled Resource Consumption flaw: the streaming reader used by Rows/GetRows validates cell coordinates but does not clamp the standalone row 'r' attribute against TotalRows. When a row element supplies a huge r value (far above 1,048,576) and omits cell coordinates, the reader backfills empty rows to reach that index, so a few bytes of XML expand into millions-to-billions of in-memory row slots. The affected package per CPE is cpe:2.3:a:qax-os:excelize, all versions prior to 2.11.0.
RemediationAI
Vendor-released patch: 2.11.0 - upgrade the dependency to v2.11.0 or later and rebuild/redeploy as the primary and complete fix; the corrective change is in PR https://github.com/qax-os/excelize/pull/2331 and commit 93f0b3caed37f21ef5079e3259c6c21dcfe68453, with details in advisory https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc. If an immediate upgrade is not possible, reduce exposure by refusing or sandboxing untrusted XLSX uploads, imposing strict per-request memory and CPU limits (for example container memory caps or a killable worker process) so one malicious file cannot exhaust the host, and where feasible pre-validating the worksheet XML to reject any row element whose r attribute exceeds 1,048,576 before calling GetRows. These controls add latency and processing complexity and do not remove the underlying amplification, so treat them as stopgaps until v2.11.0 is deployed.
Denial of service in the Excelize Go library (github.com/xuri/excelize/v2, a.k.a. qax-os/excelize) before 2.11.0 allows
Panic-triggering denial of service in the Excelize Go library (all versions prior to 2.11.0) allows any actor who can su
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today