CVE-2026-59161
Vulnerability Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-400
Source
NVD
Vendor
qax-os
Product
excelize
Discussion (0)
Add Comment
No comments yet. Be the first!