CVE-2026-108359

The PhpSpreadsheet PHP library (prior to versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0 ) is vulnerable to a Denial of Service (DoS) attack via the ODS reader. The root cause is located in Ods::processTableRow within src/PhpSpreadsheet/Reader/Ods.php, where the component accepts an unbounded ...

CVE-2026-108359 PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a...