Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M
CVE-2026-107212Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
High 7.5
In plain English
A high-severity resource allocation without limits in excelize from qax-os. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/360EntSecGroup-Skylar/excelize/v2 | no fix listed | GO-2026-6685 |
| Go | github.com/xuri/excelize/v2 | 2.11.1-0.20260930021559-01a9ff32fb3c | GHSA-jw42-f3rr-4cc3 |
| Go | github.com/xuri/excelize/v2 | 2.11.1-0.20260930021559-01a9ff32fb3c | GO-2026-6685 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3 x_refsource_CONFIRM
- https://github.com/qax-os/excelize/pull/2438 x_refsource_MISC
- https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23 x_refsource_MISC