{"id":"EUVD-2026-42936","enisaUuid":"a8367dfd-7d17-3c68-9b26-c2b88a21e057","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.","datePublished":"Jul 10, 2026, 3:47:38 PM","dateUpdated":"Jul 14, 2026, 1:55:21 AM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc\nhttps://github.com/qax-os/excelize/pull/2331\nhttps://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453\nhttps://github.com/qax-os/excelize/releases/tag/v2.11.0\n","aliases":"CVE-2026-59161\nGHSA-q5j5-6p94-4gwc\n","assigner":"GitHub_M","epss":0.66,"enisaIdProduct":[{"id":"59046df4-9f72-3b65-b522-88632c1bae18","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"\u003c 2.11.0"}],"enisaIdVendor":[{"id":"0da1ed6b-0058-3cf3-894e-6522967ba69d","vendor":{"name":"qax-os"}}],"enisaIdVulnerability":[{"id":"24b42279-0ac0-3ad8-a73e-b81797e64dd0","vulnerability":{"id":"CVE-2026-59161","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.","datePublished":"Jul 10, 2026, 3:47:38 PM","dateUpdated":"Jul 14, 2026, 1:55:21 AM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc\nhttps://github.com/qax-os/excelize/pull/2331\nhttps://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453\nhttps://github.com/qax-os/excelize/releases/tag/v2.11.0\n","enisa_id":"EUVD-2026-42936\n","assigner":"GitHub_M","epss":0.66,"dataProcessed":"Nov 7, 2026, 7:21:40 AM","vulnerabilityProduct":[{"id":"ffb7f9e3-e292-3691-add4-1fef09be307d","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"\u003c 2.11.0"}],"vulnerabilityVendor":[{"id":"4f103fd4-f6a4-3851-9091-e531514d7c53","vendor":{"name":"qax-os"}}]}},{"id":"e0aa37ca-a888-3d7f-b366-5ef4b88d3f85","vulnerability":{"id":"GHSA-q5j5-6p94-4gwc","description":"Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation","datePublished":"Sep 10, 2026, 3:09:09 PM","dateUpdated":"Sep 10, 2026, 3:09:09 PM","baseScore":0.0,"references":"https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59161\nhttps://github.com/qax-os/excelize/pull/2331\nhttps://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453\nhttps://github.com/qax-os/excelize\nhttps://github.com/qax-os/excelize/releases/tag/v2.11.0\n","enisa_id":"EUVD-2026-42936\n","aliases":"CVE-2026-59161\nGHSA-q5j5-6p94-4gwc\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}