{"id":"GO-2026-6453","revision":"ff6a58397277448aaf7685abadb65f4a","records":[{"revision":"ff6a58397277448aaf7685abadb65f4a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6453","aliases":["CVE-2026-59161","GHSA-q5j5-6p94-4gwc"],"title":"Unbounded memory allocation via streaming row reader in github.com/xuri/excelize","description":"In github.com/xuri/excelize/v2, the streaming worksheet reader used by Rows and GetRows does not enforce the maximum row limit (TotalRows) on row \"r\" attributes. A crafted spreadsheet with an out-of-bounds row index causes GetRows to allocate empty row slices up to the specified row number, leading to excessive memory consumption and denial of service.","state":0,"publishedAt":"2026-09-16T18:00:43+00:00","modifiedAt":"2026-09-17T17:30:11.2493243+00:00","affected":[{"ecosystem":"Go","name":"github.com/xuri/excelize/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.11.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc","https://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453","https://github.com/qax-os/excelize/pull/2331","https://github.com/qax-os/excelize/releases/tag/v2.11.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6453","license":"OSV · upstream source license applies","key":"osv:GO-2026-6453","identifiers":["GO-2026-6453","CVE-2026-59161","GHSA-q5j5-6p94-4gwc"]},"retained":false,"historicalAffected":[]}],"coverage":[]}