# CVE-2026-108359: PhpSpreadsheet denial-of-service via unbounded row repetition

Source: https://junglewise.ai/threats/cve-2026-108359-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-108359 · Severity: high · CVSS 4 · Published 2026-10-22

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. An attacker can craft a malicious ODS spreadsheet file with an unbounded table row repetition attribute that causes the library to consume excessive CPU and memory, crashing the PHP worker process. This affects applications that parse user-supplied ODS files without validation.

Technologies: [phpoffice/phpspreadsheet (Packagist)](https://junglewise.ai/threats/technologies/phpoffice-phpspreadsheet), [Phpoffice Phpspreadsheet](https://junglewise.ai/threats/technologies/phpspreadsheet). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Phpoffice](https://junglewise.ai/threats/vendors/phpoffice).

## Quick answers

**Is CVE-2026-108359 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108359 being exploited in the wild.

**How severe is CVE-2026-108359?** High severity, with a CVSS score of 4, published 22 October 2026.

**Which products and versions are affected?** phpoffice/phpspreadsheet (Packagist) >= 4.0.0, <= 5.9.0, ECOSYSTEM:introduced=4.0.0,fixed=5.10.0; Phpoffice Phpspreadsheet before 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

**Is there a fix for CVE-2026-108359?** Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108359 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-108359?** Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later

  ```sh
  composer require phpoffice/phpspreadsheet:^5.10.0
  ```


## Technical details

The Ods::processTableRow method in src/PhpSpreadsheet/Reader/Ods.php fails to validate the table:number-rows-repeated attribute, allowing an attacker to specify an arbitrarily large repetition count. When a row contains a value, the reader materializes a cell for every repetition without checking against the spreadsheet row limit, causing unbounded memory and CPU consumption. A small ODS file can trigger a denial-of-service condition on the PHP worker.

## Affected products

- PHPOffice PhpSpreadsheet before 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0

## Identifiers

- CVE-2026-108359
- GHSA-j2w7-387v-m2rq

## Timeline

- 2026-10-22: disclosed
- 2026-09-15: patched

## References

- [https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66](https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66)
- [https://github.com/PHPOffice/PhpSpreadsheet/commit/2de29384aa11223ee08136c0e6a9e9981bc1a2eb](https://github.com/PHPOffice/PhpSpreadsheet/commit/2de29384aa11223ee08136c0e6a9e9981bc1a2eb)

## Related threats

- [PHPOffice PhpSpreadsheet redirect validation bypass in external image loading](https://junglewise.ai/threats/cve-2026-108360-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet XmlScanner XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108358-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PHPOffice PhpSpreadsheet XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108357-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [MediaWiki DataTransfer Extension uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-100242-dependency-on-vulnerable-third-party-component-and-uncontrolled)
- [PHPOffice PhpSpreadsheet denial of service via Gnumeric gzip expansion](https://junglewise.ai/threats/cve-2026-59932-phpoffice-phpspreadsheet-denial-of-service-via-gnumeric-gzip)