{"id":"CVE-2026-107212","kind":"vulnerability","aliases":["CVE-2026-107212","GHSA-jw42-f3rr-4cc3","GO-2026-6685"],"related":[],"title":"Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days in github.com/xuri/excelize","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.","summary":"Excelize, a Go library for reading and writing Excel files, versions 2.1.0 through 2.11.0 fail to enforce a row-number limit in Rows.Columns, so a crafted worksheet makes GetRows or the Rows iterator loop through every missing row. An attacker who can supply a spreadsheet can tie up a CPU core for as long as they choose.","severity":"high","cvss":7.5,"epss":0.00343,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/360EntSecGroup-Skylar/excelize/v2","fixed":[],"affected":">= 2.1.0","ecosystem":"go"},{"name":"github.com/xuri/excelize/v2","fixed":["2.11.1-0.20260930021559-01a9ff32fb3c"],"affected":"< 2.11.1-0.20260930021559-01a9ff32fb3c","ecosystem":"go"}],"ecosystems":["go"],"tags":["excelize","file-upload","go","package","spreadsheet-parsing"],"not_affected_if":["default-config","no-untrusted-xlsx-input","version-outside-2.1.0-to-2.11.0"],"how_to_check":"Run `go list -m github.com/xuri/excelize/v2` and `go list -m github.com/360EntSecGroup-Skylar/excelize/v2` in each Go module, or grep go.sum for excelize.\nIf the version is 2.1.0 through 2.11.0, or below the listed fix, the module is affected.","fix":"Move to 2.11.1-0.20260930021559-01a9ff32fb3c, the fixed version listed in the govuln product data. The NVD text says no fixed version exists, so confirm before relying on it.","status":"open","published_at":"2026-10-07T18:17:18+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:14+00:00","updated_at":"2026-10-23T19:56:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:56:14Z","model":"claude-haiku-5-5","output":{"fix":"Move to 2.11.1-0.20260930021559-01a9ff32fb3c, the fixed version listed in the govuln product data. The NVD text says no fixed version exists, so confirm before relying on it.","summary":"Excelize, a Go library for reading and writing Excel files, versions 2.1.0 through 2.11.0 fail to enforce a row-number limit in Rows.Columns, so a crafted worksheet makes GetRows or the Rows iterator loop through every missing row. An attacker who can supply a spreadsheet can tie up a CPU core for as long as they choose.","category":"package","who_cares":["go","excelize","file-upload","spreadsheet-parsing"],"confidence":0.7,"analyst_note":"Sources conflict on whether a fix exists: govuln lists 2.11.1-0.20260930021559-01a9ff32fb3c as fixed, while the NVD description says none is available. Check https://pkg.go.dev/vuln/GO-2026-6685 and the upstream excelize release for the fixed version.","how_to_check":"Run `go list -m github.com/xuri/excelize/v2` and `go list -m github.com/360EntSecGroup-Skylar/excelize/v2` in each Go module, or grep go.sum for excelize.\nIf the version is 2.1.0 through 2.11.0, or below the listed fix, the module is affected.","needs_analyst":true,"not_affected_if":["version-outside-2.1.0-to-2.11.0","no-untrusted-xlsx-input","default-config"],"severity_if_unknown":"unknown"},"cost_usd":0.000761,"input_tokens":2389,"output_tokens":1045,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107212':22A,33A '-2026':21A,29A,32A '-6685':30A '/360entsecgroup-skylar/excelize/v2':36A '/xuri/excelize':19A '/xuri/excelize/v2':39A '2.1.0':60B,121C '2.11.0':62B,123C '4cc3':27A 'accept':125C 'advanc':184C 'ahead':129C 'allow':195C 'appli':135C 'applic':176C 'attack':89B,197C,206C 'attacker-control':205C 'attribut':153C 'avail':213C 'call':177C 'check':157C 'choos':106B 'consum':149C,199C 'control':207C 'core':100B,202C 'cpu':99B,201C 'craft':75B,162C 'cve':20A,31A 'day':15A 'durat':208C 'enforc':65B,138C 'everi':85B,186C 'excel':1A,40B,49B,57B,107C,118C 'f3rr':26A 'fail':63B 'file':42B,58B 'file-upload':41B 'file.getrows':141C 'fix':210C 'getrow':8A,78B,178C 'ghsa':24A 'ghsa-jw42-f3rr-4cc3':23A 'github.com':18A,35A,38A 'github.com/360entsecgroup-skylar/excelize/v2':34A 'github.com/xuri/excelize':17A 'github.com/xuri/excelize/v2':37A 'go':28A,44B,51B,110C 'instead':190C 'iter':12A,82B,180C,183C 'jw42':25A 'languag':111C 'librari':52B,112C 'limit':70B,137C,156C 'long':103B 'look':128C 'look-ahead':127C 'loop':13A,83B 'make':7A,77B 'microsoft':117C 'miss':86B,187C 'number':4A,69B,131C,168C,189C 'ordinari':171C 'overs':166C 'packag':45B 'pars':48B 'place':164C 'r':152C 'read':54B,114C 'reject':192C 'reli':142C 'review':217C 'row':3A,11A,68B,81B,87B,130C,151C,167C,173C,181C,188C 'row-numb':67B 'rows.columns':6A,72B,124C,146C,148C 'rows.next':140C,144C,159C 'spreadsheet':47B,94B,119C 'spreadsheet-pars':46B 'suppli':92B 'tie':96B 'totalrow':133C 'unbound':2A 'upload':43B 'valid':172C 'version':59B,211C 'without':134C,154C 'workbook':194C 'worksheet':76B,163C 'write':56B,116C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T18:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6685","url":"https://pkg.go.dev/vuln/GO-2026-6685","severity":null,"published_at":"2026-10-19T21:08:21+00:00","modified_at":"2026-10-19T21:08:21+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107212","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107212","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107212","severity":null,"published_at":"2026-10-07T18:17:18+00:00","modified_at":"2026-10-13T14:24:29+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}