Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation

Published September 10, 2026 CVE-2026-59161

Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation. Streaming GetRows row-bound bypass causes attacker-controlled allocation Summary Excelize's prior row-bound fix for GHSA-h69g / CVE-2026-54063 protects the checked worksheet parser, but the streaming worksheet reader used by Rows and GetRows does not enforce the same TotalRows bound on the row r attribute.

Severity
HighCVSS 3.1 · 7.5
Fix
Update availableFix recorded yesterday
Affected versions
before 2.11.0
Weakness
CWE-400Uncontrolled Resource Consumption
Exploit likelihood
0.39% in 30 daysEPSS, higher than 33% of known flaws
Affects
Excelize

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact None No data tampering
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Open in FIRST.org calculator

References

View Original Source