CVE-2026-54063: Excelize DoS via Malicious Row Attributes—Denial of Service Risk

Technical summary

The checkSheet() function in Excelize prior to 2.11.0 reads the row attribute (r) from XLSX XML markup without enforcing the Excel row limit of 1,048,576. The attacker-controlled value is passed directly to make([]xlsxRow, row), creating a slice with the specified capacity. When r=2147483647, this attempts to allocate approximately 16 GB of memory, causing out-of-memory termination. Alternatively, when r is set to a negative value such as -1, the runtime panics due to out-of-bounds slice indexing. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling).

Business impact

Any application or service using Excelize to process user-supplied XLSX files faces availability risk. Affected services could experience sudden crashes, memory exhaustion, and service interruptions. This is particularly concerning for document processing platforms, data pipeline workers, reporting systems, and APIs that accept file uploads. Attackers can disrupt service without authentication, making this a reliable denial-of-service vector against public-facing or internal tools.

Affected systems

The vulnerability affects Excelize versions prior to 2.11.0. The impact is limited to applications that: (1) use the Excelize library, (2) process XLSX files from untrusted sources, and (3) call GetCellValue or related functions that trigger checkSheet(). Go-based applications and services integrating Excelize are the primary targets.

Exploitability

Exploitability is high and straightforward. An attacker need only craft an XLSX file with a malicious row attribute and send it to a vulnerable service. No authentication, user interaction, or special privileges are required. The attack succeeds immediately upon file processing. The CVSS score of 7.5 reflects the high likelihood of exploitation and significant availability impact, though confidentiality and integrity are unaffected.

Remediation

Upgrade Excelize to version 2.11.0 or later, which implements proper validation of the row attribute against Excel's row limits. Organizations unable to update immediately should implement input validation or sandboxing for XLSX file processing, restrict file uploads to trusted sources, and monitor services for unexpected memory spikes or crashes.

Patch guidance

Apply Excelize version 2.11.0 or newer. For Go projects using go.mod, update the dependency by running 'go get -u github.com/xuri/excelize/v2' and rebuild. Verify the update by checking your go.mod file shows v2.11.0 or later. Test the updated library against your application's file processing workflows before production deployment.

Detection guidance

Monitor for: (1) sudden out-of-memory errors or process terminations in applications using Excelize, especially following file uploads; (2) runtime panic messages referencing slice allocation failures; (3) unusual memory consumption spikes correlated with XLSX file processing; (4) HTTP 5xx errors or service unavailability following file submission. Log XLSX parsing errors and alert on repeated failures from the same source. Consider scanning uploaded XLSX files for unusually large row attributes as a preventive measure.

Why prioritize this

This vulnerability warrants urgent patching priority due to its ease of exploitation, lack of authentication requirements, and direct impact on service availability. Any organization operating file processing services should treat this as a critical update. The attack surface is broad—any publicly accessible XLSX upload endpoint becomes an immediate DoS vector.

Risk score, explained

The CVSS 7.5 HIGH score reflects a network-exploitable, low-complexity attack with no privileges or user interaction needed, resulting in complete availability loss (integrity and confidentiality are not impacted). The severity is driven by reliability of exploitation and the prevalence of Excel file handling in business applications. Organizations relying on Excelize-based services should treat this as a priority remediation item.

Frequently asked questions