---
id: "CVE-2026-107212"
kind: "vulnerability"
aliases: ["CVE-2026-107212", "GHSA-jw42-f3rr-4cc3", "GO-2026-6685"]
title: "Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days in github.com/xuri/excelize"
severity: "high"
cvss: 7.5
epss: 0.00343
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/360EntSecGroup-Skylar/excelize/v2", "fixed": [], "affected": ">= 2.1.0", "ecosystem": "go"}, {"name": "github.com/xuri/excelize/v2", "fixed": ["2.11.1-0.20260930021559-01a9ff32fb3c"], "affected": "< 2.11.1-0.20260930021559-01a9ff32fb3c", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["excelize", "file-upload", "go", "package", "spreadsheet-parsing"]
not_affected_if: ["default-config", "no-untrusted-xlsx-input", "version-outside-2.1.0-to-2.11.0"]
published_at: "2026-10-07T18:17:18+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:56:14+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6685", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-107212", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107212", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days in github.com/xuri/excelize

Excelize, a Go library for reading and writing Excel files, versions 2.1.0 through 2.11.0 fail to enforce a row-number limit in Rows.Columns, so a crafted worksheet makes GetRows or the Rows iterator loop through every missing row. An attacker who can supply a spreadsheet can tie up a CPU core for as long as they choose.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/360EntSecGroup-Skylar/excelize/v2 affected >= 2.1.0 fixed ?
- go:github.com/xuri/excelize/v2 affected < 2.11.1-0.20260930021559-01a9ff32fb3c fixed 2.11.1-0.20260930021559-01a9ff32fb3c

## How to check

Run `go list -m github.com/xuri/excelize/v2` and `go list -m github.com/360EntSecGroup-Skylar/excelize/v2` in each Go module, or grep go.sum for excelize.
If the version is 2.1.0 through 2.11.0, or below the listed fix, the module is affected.

## Fix

Move to 2.11.1-0.20260930021559-01a9ff32fb3c, the fixed version listed in the govuln product data. The NVD text says no fixed version exists, so confirm before relying on it.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6685
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-107212
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107212

## From the sources

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_