High severity · published Oct 22, 2026
CVE-2026-108359
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
New
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materializes a cell for every repetition without checking the spreadsheet row limit, so a small attacker-controlled ODS file can consume substantial CPU and memory and terminate the PHP worker. Column repetition is separately bounded and is not part of this vulnerability. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PhpSpreadsheet · PHPOffice
< 1.30.7; >= 2.0.0, < 2.1.19; >= 2.2.0, < 2.4.8; >= 3.3.0, < 3.10.8; >= 4.0.0, < 5.10.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-108359
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-108359
github.com
https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66
github.com
https://github.com/PHPOffice/PhpSpreadsheet/commit/2de29384aa11223ee08136c0e6a9e9981bc1a2eb
github.com
https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738
github.com
https://github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9
github.com
https://github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c
github.com
https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7
More from PhpSpreadsheet
9.8
CVE-2026-34084
PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load
9.2
CVE-2026-45034
PhpSpreadsheet: File::prohibitWrappers bypass
8.8
CVE-2026-108357
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
8.8
CVE-2026-108358
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
8.8
CVE-2024-45291
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files
