Memory and CPU Consumption Vulnerability in Excelize Library by Qaxos

CVE-2026-59161

What is CVE-2026-59161?

The Excelize library, used for reading and writing Microsoft Excel spreadsheets in Go, has a vulnerability that enables an attacker to manipulate the TotalRows limit, causing excessive memory and CPU consumption. This issue occurs when processing small XLSX files with manipulated row numbers exceeding 1,048,576. Without proper controls, the GetRows function may append empty rows up to the attacker-defined index, leading to potential denial-of-service scenarios. This vulnerability was addressed in version 2.11.0 of the library.

References