—
GO-2026-6453
Unbounded memory allocation via streaming row reader in github.com/xuri/excelize
Quick fix
GO-2026-6453 — github.com/xuri/excelize/v2: upgrade to the fixed version with the command below.
go get github.com/xuri/excelize/v2@v2.11.0Details
In github.com/xuri/excelize/v2, the streaming worksheet reader used by Rows and GetRows does not enforce the maximum row limit (TotalRows) on row "r" attributes. A crafted spreadsheet with an out-of-bounds row index causes GetRows to allocate empty row slices up to the specified row number, leading to excessive memory consumption and denial of service.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/xuri/excelize/v2
Introduced in:
0Fixed in: 2.11.0Fix
go get github.com/xuri/excelize/v2@v2.11.0