CVE-2026-59161 Details
Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.
A vulnerability in the Excelize library prior to version 2.11.0 allows for a row-bound bypass in the streaming worksheet reader used by the Rows and GetRows functions. This vulnerability enables an attacker to manipulate the TotalRows limit, causing excessive memory and CPU consumption. The issue arises because the streaming reader does not enforce the same row limits as the checked parser, allowing small XLSX files to exploit the row r attribute and create empty rows up to an attacker-controlled index.
Users can update to Excelize version 2.11.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc | CISA-ADP | ExploitVendor Advisory |
| https://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453 | [email protected] | Patch |
| https://github.com/qax-os/excelize/pull/2331 | [email protected] | Issue TrackingPatch |
| https://github.com/qax-os/excelize/releases/tag/v2.11.0 | [email protected] | Release Notes |
| https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| excelize excelize | < 2.11.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |