PT-2026-57360

Unbounded Row Index Allocation in Worksheet Parser checkSheet OOM/Panic DoS Summary The checkSheet function in github.com/xuri/excelize/v2 uses an attacker-controlled XML attribute value directly as the length argument to makexlsxRow, row without validating it against the Excel row limit TotalRow...

CVE-2026-59162: Uncaught Exception

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with ...

CVE-2026-59161: Uncontrolled Resource Consumption

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell...

CVE-2026-54063: Allocation of Resources Without Limits or Throttling

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet function in github.com/xuri/excelize/v2 uses an attacker-controlled XML attribute value directly as the length argument to makexlsxRow, row without validating it against the Exc...

PT-2026-56159

Name of the Vulnerable Software and Affected Versions Excelize versions prior to 2.11.0 Description Excelize is a Go language library used for reading and writing Microsoft Excel spreadsheets. The library parses shared-string cell values using the strconv.Atoi function but only verifies the upper...

PT-2026-107662

Name of the Vulnerable Software and Affected Versions Excelize versions 2.1.0 through 2.11.0 Description An issue exists where the library fails to validate the Min and Max attributes of column ranges loaded from a file against the worksheet column limit. When a crafted worksheet contains an...