CVE-2021-32013: Oracle Rest Data Services

Medium severity, CVSS 5.5. EPSS: 0.9% chance of exploitation in the next 30 days.

SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).

Affected products

• Oracle Rest Data Services: before 21.2.4 (fixed in 21.2.4)
• Sheetjs Project Sheetjs: up to and including 0.16.9
• Sheetjs Project Sheetjs Pro: up to and including 0.16.9

Published 2021-07-19. Last modified 2026-06-17.