CVE-2026-59161High· 7.5▾ TwilightExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a smal…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.
excelize < 2.11.0Upgrade past the affected range:
excelize 2.11.0Affected packages:
github.com/xuri/excelize/v2 < 2.11.0github.com/xuri/excelize <= 1.4.0Patched in:
github.com/xuri/excelize/v2 2.11.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59162High· 7.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
CVE-2024-12254High· 7.5Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark"
CVE-2026-42127High· 7.5The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads
CVE-2026-25535High· 7.5jsPDF is a library to generate PDFs in JavaScript
CVE-2026-49476High· 7.5Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists
CVE-2026-40192High· 7.5Pillow is a Python imaging library