Executive brief
A vulnerability in the Excelize library, used by Go applications to process Excel files, allows an attacker to crash the application or exhaust its memory. By providing a specially crafted spreadsheet file, an attacker can force the system to attempt a massive memory allocation or trigger a software error. This can lead to a complete service outage for any application that processes user-uploaded Excel documents.
Technical details
The vulnerability exists in the `checkSheet()` function within `github.com/xuri/excelize/v2`. The parser reads the `<row r="N">` XML attribute and uses it directly as a length argument for `make([]xlsxRow, row)` without validating it against the `TotalRows` limit (1,048,576). An attacker can provide a large integer (e.g., 2147483647) to trigger an out-of-memory (OOM) fatal error or a negative value (e.g., -1) to trigger a runtime panic due to out-of-bounds slice indexing. The issue is reachable via public APIs like `GetCellValue` that internally invoke the worksheet reader. A fix is available in version 2.11.0.
Affected products
- xuri excelize < 2.11.0
Timeline
- 2026-06-03: disclosed
- 2026-07-10: advisory: GHSA-h69g-9hx6-f3v4 published
- 2026-07-10: patched: Fixed in version 2.11.0