EUVD-2026-94531

Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks...

GHSA-2J4C-FFCH-9F23 Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

Summary Any file whose first 8 bytes are the OLE compound-file signature D0 CF 11 E0 A1 B1 1A E1 is routed by OpenFile/OpenReader/OpenBytes → openReaderAt → Decrypt. The version dispatch only guarantees lenEncryptionInfo = 4 before handing attacker-controlled EncryptionInfo/EncryptedPackage buffe...

Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

Summary Any file whose first 8 bytes are the OLE compound-file signature D0 CF 11 E0 A1 B1 1A E1 is routed by OpenFile/OpenReader/OpenBytes → openReaderAt → Decrypt. The version dispatch only guarantees lenEncryptionInfo = 4 before handing attacker-controlled EncryptionInfo/EncryptedPackage buffe...

GHSA-X2Q3-8CJH-766F Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

Summary extractPart allocates directly from the mscfb directory-entry size with no clamping crypt.go:198, same missing bound at crypt.go:204: go buf := makebyte, entry.Size entry.Size is the raw streamSize field from the attacker-controlled CFB directory entry mscfb v1.0.8 fixFile, file.go:109-12...

EUVD-2026-94533

Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS...

Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

Summary extractPart allocates directly from the mscfb directory-entry size with no clamping crypt.go:198, same missing bound at crypt.go:204: go buf := makebyte, entry.Size entry.Size is the raw streamSize field from the attacker-controlled CFB directory entry mscfb v1.0.8 fixFile, file.go:109-12...

WebAttackDetector

WebAttackDetector Static machine-learning triage for suspicio...

GHSA-WP2G-VPJJ-G53R Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow

Summary ANCHORARRAY calc.go:15137 on current master evaluates each cell of the referenced spill range by calling the exported CalcCellValue, which unconditionally constructs a fresh calcContext — fresh entry marker, fresh iterations map, full MaxCalcIterations budget calc.go:896-900. The...

EUVD-2026-94534

Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow...

Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow

Summary ANCHORARRAY calc.go:15137 on current master evaluates each cell of the referenced spill range by calling the exported CalcCellValue, which unconditionally constructs a fresh calcContext — fresh entry marker, fresh iterations map, full MaxCalcIterations budget calc.go:896-900. The...

EUVD-2026-94643

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source...

GHSA-MFJ3-87QQ-382V AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

Impact The client nonce used in HTTP Digest authentication was generated from ThreadLocalRandom, a fast but non-cryptographic pseudorandom number generator. RFC 7616 section 3.3 requires the cnonce to be unpredictable, since it is part of what protects the Digest exchange against chosen-plaintext...

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

Impact The client nonce used in HTTP Digest authentication was generated from ThreadLocalRandom, a fast but non-cryptographic pseudorandom number generator. RFC 7616 section 3.3 requires the cnonce to be unpredictable, since it is part of what protects the Digest exchange against chosen-plaintext...

EUVD-2026-94645

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel...

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

Impact When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTTP CONNECT, the same as it does for https://. Once the tunnel is open, the WebSocket upgrade request that follows is sent through the tunnel directly to th...

GHSA-3WP9-XFWM-RJJF AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

Impact When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTTP CONNECT, the same as it does for https://. Once the tunnel is open, the WebSocket upgrade request that follows is sent through the tunnel directly to th...

AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

Impact The cookie store decides whether a Domain attribute may be accepted using only the domain-matching rule of RFC 6265 Section 5.1.3, which asks whether the request host is the domain or ends with a dot followed by it. Section 5.3 step 5, which additionally requires rejecting a Domain that is...

GHSA-F9M8-CV68-674W AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

Impact The cookie store decides whether a Domain attribute may be accepted using only the domain-matching rule of RFC 6265 Section 5.1.3, which asks whether the request host is the domain or ends with a dot followed by it. Section 5.3 step 5, which additionally requires rejecting a Domain that is...

EUVD-2026-94639

AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk...

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

Impact When a request is replayed onto a different host, the client updates only the current request and leaves the target request pointing at the original host. Four consumers read that stale value, and each one sends the first host's request, credentials, or both to the second host. A replay...