CVE-2026-59161: excelize Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-59161 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in excelize. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 10-07-2026PublishedVulnerability first disclosed.
- 14-07-2026Last modifiedVulnerability information updated.
Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · GoEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.66%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
+0.26 pp
From 0.39% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExcelize
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Excelize1 product
- excelize< 2.11.0
Github.com/xuri1 product
- excelize≤ 1.4.0
Github.com/xuri/excelize1 product
- v2< 2.11.0
Qax-os1 product
- excelize< 2.11.0
4 vendors · 4 products
References
6 links- github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwcX Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453X Refsource MISCWEBFIXPatch
- github.com/qax-os/excelizePACKAGE