PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
High · fetched 2026-10-27
## Summary When PhpSpreadsheet loads an OpenDocument Spreadsheet (`.ods`), `Ods::processTableRow()` reads the `table:number-rows-repeated` attribute of a `<table:table-row>` with an unchecked `(int)` cast, then materialises one cell per repeated row. This value is **completely unbounded**, so a **single ~1.4 KB file** can instruct the reader to create up to **millions of cells**, exhausting memory (fatal OOM). No authentication, no special configuration, and the default read filter are required - any application that loads a user-supplied `.ods` is affected.
Remediation
Upgrade phpoffice/phpspreadsheet to 5.10.0 or later. Upgrade phpoffice/phpspreadsheet to 3.10.8 or later. Upgrade phpoffice/phpspreadsheet to 2.4.8 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-27T12:20:12-04:00 · https://github.com/advisories/GHSA-j2w7-387v-m2rq