{"id":"ghsa-ghsa-j2w7-387v-m2rq","seq":1708784,"kind":"advisory","title":"PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)","url":"https://github.com/advisories/GHSA-j2w7-387v-m2rq","permalink":"https://vulnpulse.app/items/ghsa-ghsa-j2w7-387v-m2rq","summary":"影響: composer:phpoffice/phpspreadsheet >= 4.0.0, <= 5.9.0 → 5.10.0, composer:phpoffice/phpspreadsheet >= 3.3.0, <= 3.10.7 → 3.10.8, composer:phpoffice/phpspreadsheet >= 2.2.0, <= 2.4.7 → 2.4.8, composer:phpoffice/phpspreadsheet >= 2.0.0, <= 2.1.18 → 2.1.19, composer:phpoffice/phpspreadsheet <= 1.30.6 → 1.30.7\nWhen PhpSpreadsheet loads an OpenDocument Spreadsheet (.ods), Ods::processTableRow() reads the table:number-rows-repeated attribute of a with an unchecked (int) cast, then materialises one cell per repeated row. This value is completely unbounded, so a single ~1.4 KB file can instruct the reader to create up to millions of cells, exhausting memory (fatal OOM). No authentication, no special configuration, and the default read filter are required - any application that loads a user-supplied .ods…","severity":"high","techs":["php"],"cves":["CVE-2026-108359"],"tags":["GHSA-j2w7-387v-m2rq","phpoffice/phpspreadsheet","phpoffice/phpspreadsheet","phpoffice/phpspreadsheet","phpoffice/phpspreadsheet","phpoffice/phpspreadsheet"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:38:33.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}