CVE-2026-59161

Katalog CVE

CVSS 7.5 · High EPSS 0,66%

Kerentanan Uncontrolled Resource Consumption pada excelize. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

16 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc exploit · advisory vendor
• https://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453 patch
• https://github.com/qax-os/excelize/pull/2331 issue tracking · patch
• https://github.com/qax-os/excelize/releases/tag/v2.11.0 release notes