EUVD-2026-42937
GHSA-fx5j-qcqg-grpf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via crafted file upload with no authentication or interaction in automated pipelines; impact is limited to application crash with no confidentiality or integrity effect.
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with -1 to trigger sharedStrings[-1] and panic when read through GetCellValue or GetRows. This issue is fixed in version 2.11.0.
AnalysisAI
Panic-triggering denial of service in the Excelize Go library (all versions prior to 2.11.0) allows any actor who can supply a crafted XLSX file to crash the consuming application. The root cause is an integer bounds check that validates only the upper bound of shared-string indices, permitting a cell value of -1 to reach a slice-index operation as a negative integer and cause a Go runtime panic in GetCellValue or GetRows. No active exploitation has been identified at time of analysis, but the attack is trivially constructable and requires no privileges if the target application exposes XLSX processing to untrusted input.
Technical ContextAI
Excelize (CPE: cpe:2.3:a:qax-os:excelize:*:*:*:*:*:*:*:*) is a Go library for reading and writing OOXML-format Excel workbooks. In the OOXML format, string cell values are stored in a shared-strings XML segment and referenced from individual cells by integer index. Excelize parses these indices using strconv.Atoi, which correctly returns negative integers for inputs such as '-1'. The pre-patch code guarded only against indices equal to or beyond the upper bound of the shared-string slice, so a value of -1 passed that check and was used directly to index the slice - an operation Go's runtime rejects at execution time with a panic. CWE-248 (Uncaught Exception) captures this root cause: the panic propagates through any Excelize call stack that lacks an enclosing recover(), potentially crashing the host application or goroutine. The fix in v2.11.0 (commit 93f0b3caed37f21ef5079e3259c6c21dcfe68453, PR #2331) adds a lower-bound check, rejecting any parsed index less than zero before slice access occurs.
RemediationAI
Upgrade Excelize to v2.11.0, which resolves the vulnerability by adding a lower-bound index check. The fix is confirmed in release tag v2.11.0 (https://github.com/qax-os/excelize/releases/tag/v2.11.0), PR #2331 (https://github.com/qax-os/excelize/pull/2331), and commit 93f0b3caed37f21ef5079e3259c6c21dcfe68453. If immediate upgrade is not feasible, wrap all calls to GetCellValue, GetRows, and any other Excelize entry points in a Go defer recover() block to prevent panics from propagating to the host application - this eliminates the crash but does not fix the underlying flaw and may silently discard cell data, so it should be treated as a temporary measure. Additionally, restricting XLSX ingestion to verified trusted sources is an effective compensating control for services that cannot upgrade immediately, though it introduces operational friction for user-facing upload workflows. Full advisory details are at https://github.com/qax-os/excelize/security/advisories/GHSA-fx5j-qcqg-grpf.
Denial of service in the Excelize Go library (github.com/xuri/excelize/v2, a.k.a. qax-os/excelize) before 2.11.0 allows
Uncontrolled memory and CPU consumption in Excelize (qax-os/excelize), the widely used Go library for reading and writin
Same weakness CWE-248 – Uncaught Exception
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today