PhpSpreadsheet ODS Reader: Denial of service via unbounded number-rows-repeated
Summary
PhpSpreadsheet, a PHP library for reading and writing spreadsheet files, does not enforce the row limit when reading ODS files with a very large table:number-rows-repeated value. A small, specially crafted ODS file can make the PHP process consume excessive CPU and memory and terminate. The attack requires no authentication, only that an application reads attacker-supplied ODS input.
Affected
- PhpSpreadsheet before 1.30.7
- 2.0.0 before 2.1.19
- 2.2.0 before 2.4.8
- 3.3.0 before 3.10.8
- 4.0.0 before 5.10.0
Fixed in
- 1.30.7
- 2.1.19
- 2.4.8
- 3.10.8
- 5.10.0
Workaround
- Upgrade is the recommended fix.
- Avoid loading untrusted .ods files until the update is applied.
- Reject .ods uploads where they are not needed.
- Run imports in a worker process with a memory limit and timeout.
Exploitation
- CISA SSVC: exploitation status poc, automatable: yes, technical impact: partial.
- No evidence of exploitation in the wild found.
- No public exploit code found in the sources reviewed.
- Not listed in CISA KEV in the sources reviewed.
Our recommendation
- Check web applications and import jobs for phpoffice/phpspreadsheet in composer.lock files.
- If an affected version is found and the application accepts .ods files, update to the fixed release of your branch.
- Ask software vendors whether ODS upload is possible and request patched versions.
- Monitor application logs for worker crashes or memory exhaustion during file imports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- PhpSpreadsheet GitHub security advisory GHSA-j2w7-387v-m2rq github.com
- PhpSpreadsheet release 5.10.0 github.com
- PhpSpreadsheet release 1.30.7 github.com
- PhpSpreadsheet release 2.1.19 github.com
- PhpSpreadsheet release 2.4.8 github.com
- PhpSpreadsheet release 3.10.8 github.com
- GitLab Advisory Database entry for CVE-2026-108359 advisories.gitlab.com
- Tenable CVE entry CVE-2026-108359 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:43.
Original description (NVD)
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materializes a cell for every repetition without checking the spreadsheet row limit, so a small attacker-controlled ODS file can consume substantial CPU and memory and terminate the PHP worker. Column repetition is separately bounded and is not part of this vulnerability. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
NVD references (12)
- https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66
- https://github.com/PHPOffice/PhpSpreadsheet/commit/2de29384aa11223ee08136c0e6a9e9981bc1a2eb
- https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738
- https://github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9
- https://github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-j2w7-387v-m2rq
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-j2w7-387v-m2rq
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.