https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 16:00:18 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-107223 <p>Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxColumns. When a crafted worksheet supplies an oversized col max attribute and the application invokes a column mutator, flatCols performs a deep copy and append for every attacker-selected column number, allowing an attacker to consume excessive CPU and memory or trigger OOM. No fixed version is available as of this review.</p> <p>Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxColumns. When a crafted worksheet supplies an oversized col max attribute and the application invokes a column mutator, flatCols performs a deep copy and append for every attacker-selected column number, allowing an attacker to consume excessive CPU and memory or trigger OOM. No fixed version is available as of this review.</p> https://db.gcve.eu/vuln/fkie_cve-2026-107223 https://db.gcve.eu/vuln/ghsa-fq3v-74gv-27gm <p><strong>Affected:</strong> Go: github.com/xuri/excelize/v2</p> <p>### Summary</p> <p>The `max` attribute of a `&lt;col&gt;` element in `xl/worksheets/sheetN.xml` is read verbatim on open with no check against `MaxColumns`, and `flatCols()` then walks `Min..Max` doing a `deepcopy.Copy` and `append` per iteration. Executed: `max=&#34;300000&#34;`, only about 18x past the real 16384 limit, cost 46.2 s of CPU and 122 MB on a single `SetColWidth` call, and the growth is linear in `max` up to 2^31-1.</p> <p>Confirmed at `ae2113b` (HEAD at the time of audit).</p> <p>### Details</p> <p>`col.go:547`, `flatCols()`, with the two loops at `:549` and `:564`:</p> <p>```go for i := col.Min; i &lt;= col.Max; i++ { ... for i := column.Min; i &lt;= column.Max; i++ { ... fc = append(fc, deepcopy.Copy(...)) } ```</p> <p>`column.Min` and `column.Max` are plain int attributes on `xmlWorksheet.go:279-280`, bound straight from the file. `MaxColumns` is 16384 (`templates.go:176`) and nothing in the parse path compares against it.</p> <p>The contrast that makes this an oversight rather than a design decision is inside the callers themselves. `SetColWidth` validates its own column argument through `parseColRange`, which clamps to `MaxColumns`. But `flatCols` iterates `ws.Cols.Col`, the file-loaded slice, so the caller&#39;s validated argument never constrains the loop. The crafted column expands no matter which column the caller touches.</p> <p>The row axis has the guard this axis is missing: GHSA-h69g-9hx6-f3v4 capped `checkSheet`&#39;s row allocation at `TotalRows`, and GHSA-q5j5-6p94-4gwc capped streaming `Rows.Next`. There is no column-…</p> <p><strong>Affected:</strong> Go: github.com/xuri/excelize/v2</p> <p>### Summary</p> <p>The `max` attribute of a `&lt;col&gt;` element in `xl/worksheets/sheetN.xml` is read verbatim on open with no check against `MaxColumns`, and `flatCols()` then walks `Min..Max` doing a `deepcopy.Copy` and `append` per iteration. Executed: `max=&#34;300000&#34;`, only about 18x past the real 16384 limit, cost 46.2 s of CPU and 122 MB on a single `SetColWidth` call, and the growth is linear in `max` up to 2^31-1.</p> <p>Confirmed at `ae2113b` (HEAD at the time of audit).</p> <p>### Details</p> <p>`col.go:547`, `flatCols()`, with the two loops at `:549` and `:564`:</p> <p>```go for i := col.Min; i &lt;= col.Max; i++ { ... for i := column.Min; i &lt;= column.Max; i++ { ... fc = append(fc, deepcopy.Copy(...)) } ```</p> <p>`column.Min` and `column.Max` are plain int attributes on `xmlWorksheet.go:279-280`, bound straight from the file. `MaxColumns` is 16384 (`templates.go:176`) and nothing in the parse path compares against it.</p> <p>The contrast that makes this an oversight rather than a design decision is inside the callers themselves. `SetColWidth` validates its own column argument through `parseColRange`, which clamps to `MaxColumns`. But `flatCols` iterates `ws.Cols.Col`, the file-loaded slice, so the caller&#39;s validated argument never constrains the loop. The crafted column expands no matter which column the caller touches.</p> <p>The row axis has the guard this axis is missing: GHSA-h69g-9hx6-f3v4 capped `checkSheet`&#39;s row allocation at `TotalRows`, and GHSA-q5j5-6p94-4gwc capped streaming `Rows.Next`. There is no column-…</p> https://db.gcve.eu/vuln/ghsa-fq3v-74gv-27gm