Vulnerability Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Excelize | Excelize | < 2.11.0 |
Related Weaknesses (CWE)
References
- https://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe684Patch
- https://github.com/qax-os/excelize/pull/2331Issue TrackingPatch
- https://github.com/qax-os/excelize/releases/tag/v2.11.0Release Notes
- https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwcExploitVendor Advisory
- https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwcExploitVendor Advisory
FAQ
What is CVE-2026-59161?
CVE-2026-59161 is a vulnerability with a CVSS score of 7.5 (HIGH). Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on...
How severe is CVE-2026-59161?
CVE-2026-59161 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-59161?
Check the references section above for vendor advisories and patch information. Affected products include: Excelize Excelize.