CVE-2026-107212: CWE-770: Allocation of Resources Without Limits or Throttling in qax-os excelize

Excelize versions 2.1.0 to 2.11.0 contain a resource exhaustion vulnerability (CWE-770) due to the Rows.Columns method accepting a look-ahead row number beyond the TotalRows limit enforced by Rows.Next. The File.GetRows function relies on these methods but does not enforce the limit in Rows.Columns, allowing an attacker to craft a worksheet with an oversized row number after a valid row. When the application calls GetRows or iterates Rows, the iterator processes every missing row number instead of rejecting the workbook, causing prolonged CPU consumption controlled by the attacker. This vulnerability can lead to denial of service by exhausting CPU resources. No patch or fixed version is currently available.

The vulnerability allows an attacker to cause high CPU usage on systems processing malicious Excel files using affected Excelize versions. This can lead to denial of service conditions by consuming a CPU core for an attacker-controlled duration. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been documented.

No official fix or patch is currently available for this vulnerability. Users should monitor vendor advisories for updates. Until a fix is released, avoid processing untrusted Excel files with affected versions of Excelize or implement external resource usage limits where possible to mitigate potential denial of service.