CVE-2026-108359: 
PHP vulnerability analysis and mitigation

CVE-2026-108359 is a Denial of Service (DoS) vulnerability in PHPOffice PhpSpreadsheet's ODS (OpenDocument Spreadsheet) reader, caused by unbounded expansion of the table:number-rows-repeated attribute, leading to CPU and memory exhaustion. It was published on October 12, 2026, and affects all maintained release branches: ≤1.30.6, ≤2.1.18, ≤2.4.7, ≤3.10.7, and ≥4.0.0 ≤5.9.0. No authentication or special configuration is required — any application that loads a user-supplied .ods file is affected. It carries a High severity rating (GitHub Advisory).

The root cause (CWE-400: Uncontrolled Resource Consumption; CWE-789: Memory Allocation with Excessive Size Value) lies in src/PhpSpreadsheet/Reader/Ods.php, where the table:number-rows-repeated XML attribute is cast to an integer without any upper-bound check ($rowRepeats = (int) $childNode->getAttributeNS($tableNs, 'number-rows-repeated')). The subsequent row materialization loop (for ($rowAdjust = 0; $rowAdjust < $rowRepeats; ++$rowAdjust)) allocates one Cell object per repeated row with no limit, allowing a ~1.4 KB malicious .ods file to instruct the reader to instantiate millions of cells. By contrast, the column-repeat path is already bounded by AddressRange::MAX_COLUMN_INT (16,384), making only the row dimension exploitable (GitHub Advisory).

A successful exploit causes PHP fatal memory exhaustion (Allowed memory size ... exhausted), crashing the application process and rendering the service unavailable. A single crafted .ods payload specifying 5 million repeated rows (~1.4 KB file) can consume approximately 256 MB of memory at default PHP memory limits, triggering an out-of-memory (OOM) condition. The impact is limited to availability; there is no evidence of confidentiality or integrity compromise, but repeated attacks could sustain a denial-of-service condition against any application that processes user-supplied spreadsheet files (GitHub Advisory).

No authentication, special privileges, or specific configuration is required — the vulnerability is exploitable by any user who can supply a .ods file to an application using PhpSpreadsheet. A proof-of-concept payload is described in the advisory (a minimal .ods file with a number-rows-repeated value of 5,000,000). There is no current evidence of in-the-wild exploitation, threat actor attribution, or inclusion in CISA's Known Exploited Vulnerabilities catalog as of the advisory publication date (GitHub Advisory).

1. Craft malicious ODS file: Create a minimal OpenDocument Spreadsheet XML structure (~1.4 KB) containing a <table:table-row> element with the attribute table:number-rows-repeated set to a very large integer (e.g., 5,000,000) and a non-null cell value.
2. Identify target: Find a web application or service that accepts .ods file uploads and processes them using PHPOffice PhpSpreadsheet on an affected version (≤1.30.6, ≤2.1.18, ≤2.4.7, ≤3.10.7, or ≥4.0.0 ≤5.9.0).
3. Upload payload: Submit the crafted .ods file through the application's file upload interface (no authentication required if the upload endpoint is public).
4. Trigger parsing: The application calls PhpSpreadsheet's ODS reader, which reads the unbounded number-rows-repeated value and enters the unchecked materialization loop, allocating one Cell object per row.
5. Achieve DoS: PHP exhausts its memory limit, resulting in a fatal OOM error that crashes the request handler and makes the service unavailable (GitHub Advisory).

• Logs: PHP fatal error messages such as PHP Fatal error: Allowed memory size of X bytes exhausted in application or web server error logs, triggered during .ods file processing.
• Logs: Repeated or sudden spikes in failed requests associated with spreadsheet upload or import endpoints in access logs.
• File System: Presence of unusually small .ods files (≤2 KB) in upload directories that contain XML with extremely large table:number-rows-repeated attribute values.
• Process: PHP worker processes consuming abnormally high memory (approaching or exceeding configured memory_limit) and terminating unexpectedly during file import operations (GitHub Advisory).

Patched versions have been released for all affected branches: 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. Users should upgrade to the appropriate patched version via Composer (composer update phpoffice/phpspreadsheet). As a temporary workaround where upgrading is not immediately possible, applications should validate and reject .ods files before passing them to PhpSpreadsheet, or implement a custom IReadFilter to limit row processing. Restricting file upload functionality to authenticated and trusted users can also reduce exposure (GitHub Advisory).