https://vulnerability.circl.lu/sightings/feed 2026-10-08T20:14:00.566459+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/9c458693-040e-4040-95bb-e4ae5712cfce/export 2026-10-08T20:14:00.587540+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9c458693-040e-4040-95bb-e4ae5712cfce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107212", "type": "seen", "source": "https://gist.github.com/alon710/b9dd9cdea0790c847d9158c76d8625f3", "content": "# CVE-2026-107212: CVE-2026-107212: CPU Exhaustion Denial of Service via Look-Ahead Row Parsing in Excelize\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107212\n\n## Summary\nAn algorithmic complexity vulnerability (CWE-770) in the Excelize library allows remote attackers to cause resource exhaustion (100% CPU usage) via a crafted Microsoft Excel spreadsheet. This occurs because the look-ahead row index parsing in Rows.Columns() fails to enforce upper boundary limits, enabling an out-of-bounds row index to trigger an infinite seek loop inside the Rows iterator.\n\n## TL;DR\nA vulnerability in Excelize allows unauthenticated remote attackers to trigger a sustained Denial of Service (100% CPU exhaustion) by uploading an Excel file containing a row index that exceeds the platform's architectural maximum.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00339 (Percentile: 25.26%)\n- **Impact**: Denial of Service (CPU Exhaustion)\n- **Exploit Status**: PoC / Tested\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- github.com/xuri/excelize\n- github.com/qax-os/excelize\n- **excelize**: >= 2.1.0, <= 2.11.0 (Fixed in: `Commit 01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23`)\n\n## Mitigation\n\n- Update Excelize dependency to a patched version or commit hash\n- Implement context-based execution timeouts on parsing routines\n- Configure strict container-level CPU quotas to prevent host-wide starvation\n- Reject spreadsheet uploads containing abnormal metadata via perimeter inspection\n\n**Remediation Steps:**\n1. Open the project's go.mod file\n2. Update the github.com/xuri/excelize/v2 dependency to commit 01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23 or newer\n3. Run 'go mod tidy' to update the dependency tree\n4. Recompile the application and redeploy to staging environments\n5. Run verification tests with crafted out-of-bounds spreadsheet files\n\n## References\n\n- [GitHub Security Advisory GHSA-jw42-f3rr-4cc3](https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3)\n- [Official Fix Pull Request #2438](https://github.com/qax-os/excelize/pull/2438)\n- [Official Fix Commit](https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23)\n- [National Vulnerability Database (NVD) Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-107212)\n- [CVE Org Record](https://www.cve.org/CVERecord?id=CVE-2026-107212)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107212) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T17:30:30.000000Z"} 2026-10-08T17:30:30+00:00 https://vulnerability.circl.lu/sighting/dfa43ef5-13e5-4e50-8467-b17699409dd9/export 2026-10-08T20:14:00.590666+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "dfa43ef5-13e5-4e50-8467-b17699409dd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107212", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxcmyitfpa2s", "content": "\ud83d\udfe0 CVE-2026-107212 - High (7.5)\n\nExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-107212/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-07T19:01:10.172366Z"} 2026-10-07T19:01:10.172366+00:00