Denial of Service Vulnerability in PhpSpreadsheet Library
CVE-2026-108359
8.7HIGH
What is CVE-2026-108359?
The PhpSpreadsheet library, utilized for reading and writing spreadsheet files, is vulnerable to a denial of service attack. Specifically, the issue arises from the Ods::processTableRow function in the ODS reader, where it accepts an unbounded number of rows to be repeated from an ODS table. This can lead to resource exhaustion as an attacker can craft a malicious ODS file that causes excessive CPU and memory usage, potentially crashing the PHP worker. Versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0 have addressed this issue.
Affected Version(s)
PhpSpreadsheet < 1.30.7 < 1.30.7
PhpSpreadsheet >= 2.0.0, < 2.1.19 < 2.0.0, 2.1.19
PhpSpreadsheet >= 2.2.0, < 2.4.8 < 2.2.0, 2.4.8