fkie_cve-2026-107212

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.

GHSA-jw42-f3rr-4cc3 — Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

Affected: Go: github.com/xuri/excelize/v2

### Summary

A worksheet whose `<row r="...">` number is far past Excel's 1,048,576-row limit makes `File.GetRows` and the `Rows` iterator loop once for every missing row. The row limit is checked in `Rows.Next`, but not in `Rows.Columns`, which also reads `<row>` elements. A 1.5 KB file with `<row r="231999999999940">` after an ordinary first row keeps `GetRows` busy for an estimated 11 days (about 4 ns per missing row), using one CPU core and little memory. Any service that calls `GetRows` or iterates `Rows` on an uploaded workbook can be tied up by a single request.

### Details

`Rows.Next` checks the row number:

```go rowNum, _ := attrValToInt("r", xmlElement.Attr) if rowNum > TotalRows { rows.err = ErrMaxRows return false } ```

But `Rows.Columns` reads the cells of the current row by consuming tokens until it reaches the *next* `<row>` element, and it sets `rows.curRow` from that element's `r` without the check (rows.go, around line 179 at 3985c1f):

```go if rowNum, rowIterator.err = attrValToInt("r", xmlElement.Attr); rowNum != 0 { rows.curRow = rowNum } ```

After that, `rows.curRow` is 231999999999940, and each later `Next()` call takes the `rows.curRow >= rows.seekRow` shortcut and returns `true` without reading any XML. `GetRows` then calls `Next()` and `Columns()` once per row number from 2 to 231999999999940. The check in `Next()` never runs, because the oversized `<row>` element was already consumed by `Columns()`.

If the oversized row is the *f…

Most recent entries from all

fkie_cve-2026-107212

GHSA-jw42-f3rr-4cc3 — Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days