CyberRota Analysis
AI-GeneratedA vulnerability in the Excelize library prior to version 2.11.0 allows attackers to exploit the streaming worksheet reader, bypassing the TotalRows limit and causing excessive memory and CPU consumption by appending empty rows based on a manipulated row index. This can lead to denial of service conditions in applications utilizing this library. Organizations using affected versions of Excelize should prioritize upgrading to version 2.11.0 to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)