CVE-2026-108359: PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materializes a cell for every repetition without checking the spreadsheet row limit, so a small attacker-controlled ODS file can consume substantial CPU and memory and terminate the PHP worker. Column repetition is separately bounded and is not part of this vulnerability. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.30.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.1.19 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.10.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.10.0
Event History
Frequently Asked Questions
What conditions are required to trigger the denial of service?
An attacker needs to supply an ODS file containing a table row with a value and an excessively large table:number-rows-repeated attribute, and the application must process that file with an affected PhpSpreadsheet version. The issue occurs during ODS reading, when cells are materialized for each repeated row.
Are all repeated cells or columns affected?
No. The vulnerability is specific to unbounded row repetition through table:number-rows-repeated. Column repetition is separately bounded and is not part of this issue.
Which versions contain the fix?
The issue is fixed in PhpSpreadsheet versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. Versions earlier than those releases are affected.
What is the operational impact of a successful exploit?
A small crafted ODS file can drive substantial CPU and memory consumption while it is read. This can terminate the PHP worker and cause denial of service for the application handling the file.