CVE-2026-59161: qax-os Excelize uncontrolled resource consumption in streaming reader

CVE-2026-59161 · Severity: high · CVSS 4 · Published 2026-07-10

Excelize is a Go library used to read, write, and manipulate XLSX spreadsheet files. The streaming row reader (GetRows function) fails to validate row numbers the same way the standard parser does, allowing an attacker to provide a malicious XLSX file that causes the application to allocate massive amounts of memory based on an attacker-supplied row index, even if the file is tiny. This can exhaust available memory and CPU on the host system, causing a denial of service.

Technologies: github.com/xuri/excelize (Go), github.com/xuri/excelize/v2 (Go), Xuri Excelize. Vendors: Go, Xuri.

Quick answers

Is CVE-2026-59161 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59161 being exploited in the wild.
How severe is CVE-2026-59161?
High severity, with a CVSS score of 4, published 10 July 2026.
Which products and versions are affected?
github.com/xuri/excelize (Go) <= 1.4.0, SEMVER:introduced=0,last_affected=1.4.0; github.com/xuri/excelize/v2 (Go) < 2.11.0, SEMVER:introduced=0,fixed=2.11.0; Xuri Excelize < 2.11.0, <= 1.4.0.
Is there a fix for CVE-2026-59161?
Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59161 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59161?
Check whether you run github.com/xuri/excelize (Go), github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/xuri/excelize/v2 (Go): upgrade to 2.11.0 or later
    go get github.com/xuri/excelize/v2@v2.11.0

Technical details

The vulnerability is a resource-consumption bypass in Excelize's streaming worksheet reader. The checked parser path (used by standard parsing) enforces row-number limits via checkRowNum() before allocating rows. However, the streaming path used by Rows() and GetRows() directly decodes XML without applying this validation. When parsing a row element with an out-of-bounds r attribute (e.g., r="2000000"), GetRows materializes empty row slices up to that row index without validation. A cell element without an r coordinate attribute can still contain data, allowing the attack to work without triggering cell-level validation. The attack requires only the ability to provide an XLSX file to an application that calls GetRows. A proof-of-concept demonstrates that row r="2000000" allocates approximately 46 MB for a tiny file. Larger row numbers scale the allocation further. The fix was released in version 2.11.0 and involves applying row-bound validation in the streaming reader immediately after parsing row r attributes.

Affected products

  • xuri excelize <= 1.4.0
  • xuri excelize/v2 < 2.11.0

Identifiers

  • CVE-2026-59161
  • GHSA-q5j5-6p94-4gwc
  • GO-2026-6453

Timeline

  • 2026-09-10: disclosed: Vulnerability advisory published
  • 2026-09-10: patched: Fixed in v2.11.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.