GHSA-j2w7-387v-m2rq

Suggest an improvement
Source
https://github.com/advisories/GHSA-j2w7-387v-m2rq
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-j2w7-387v-m2rq/GHSA-j2w7-387v-m2rq.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-j2w7-387v-m2rq
Aliases
Published
2026-10-27T15:38:33Z
Modified
2026-10-27T15:47:24Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
Details

Summary

When PhpSpreadsheet loads an OpenDocument Spreadsheet (.ods), Ods::processTableRow() reads the table:number-rows-repeated attribute of a <table:table-row> with an unchecked (int) cast, then materialises one cell per repeated row. This value is completely unbounded, so a single ~1.4 KB file can instruct the reader to create up to millions of cells, exhausting memory (fatal OOM). No authentication, no special configuration, and the default read filter are required - any application that loads a user-supplied .ods is affected.

Affected versions

The number-rows-repeated expansion has existed in the ODS reader since its inception (pre-dating the current release branches), so all maintained lines are affected.

Branch Affected
1.x ≤ 1.30.6
2.0–2.1 ≤ 2.1.18
2.2–2.4 ≤ 2.4.7
3.x ≤ 3.10.7
4.x–5.x ≤ 5.9.0 (latest)

Root cause (source → sink)

src/PhpSpreadsheet/Reader/Ods.php:

// line 816 — row repeat, unchecked (int) cast
$rowRepeats = (int) $childNode->getAttributeNS($tableNs, 'number-rows-repeated');
...
// line 1151 — row materialisation loop: NO upper bound
for ($rowAdjust = 0; $rowAdjust < $rowRepeats; ++$rowAdjust) {
    $rID = $rowID + $rowAdjust;
    $cell = $spreadsheet->getActiveSheet()->getCell($columnID . $rID);  // allocates a Cell
    $cell->setValueExplicit($dataValue, $type);
    // ... no bounds check on $rowAdjust or $rID ...
}

Why columns are NOT vulnerable (already bounded):

The column-header loop at line 1326 shows the correct pattern with bounds checking:

// line 1326 (processTableColumnHeader): BOUNDED correctly
for ($rowRepeats2 = $rowRepeats; $rowRepeats2 > 0 && $tableColumnIndex2 <= AddressRange::MAX_COLUMN_INT; --$rowRepeats2) {
    // HAS BOUNDS CHECK: && $tableColumnIndex2 <= AddressRange::MAX_COLUMN_INT
}

Additionally, the cell-data column loop at line 1141 calls getCell() which throws exception at Coordinate.php:448 when column exceeds MAX_COLUMN_INT (XFD / 16,384):

// Coordinate.php line 448
if ($columnIndex > self::MAX_COLUMN_INT) {
    throw new Exception('Column string index can not be beyond XFD');
}

Result: Columns are capped at 16,384. Only rows are unbounded.

Impact

Memory exhaustion (single valued cell, repeated many rows):
A non-null cell value with a huge number-rows-repeated attribute materialises millions of Cell objects → PHP fatal Allowed memory size ... exhausted.

Example:

  • Payload: <table:table-row table:number-rows-repeated="5000000"> (5 million rows)
  • File size: 1.4 KB
  • Memory consumed: ~256 MB (one Cell object per row)
  • Result: OOM at default memory limit

Reproduction

Vulnerable payload (causes OOM):

<table:table table:name="Sheet1">
 <table:table-row table:number-rows-repeated="5000000">
  <table:table-cell office:value-type="float" office:value="1">
   <text:p>1</text:p>
  </table:table-cell>
 </table:table-row>
</table:table>

Not vulnerable (for reference - throws exception):

<table:table table:name="Sheet1">
 <table:table-row>
  <table:table-cell office:value-type="float" office:value="1"
      table:number-columns-repeated="1000000000">
   <text:p>1</text:p>
  </table:table-cell>
 </table:table-row>
</table:table>

This column-repeat example throws Column string index can not be beyond XFD exception (bounded defense, already in place).

Database specific 
{
    "cwe_ids":  [
        "CWE-400",
        "CWE-789"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-27T15:38:33Z",
    "nvd_published_at":  "2026-10-22T18:17:26Z",
    "severity":  "HIGH"
}
References

Affected packages

Packagist
phpoffice/phpspreadsheet

Package

Name
phpoffice/phpspreadsheet
Purl
pkg:composer/phpoffice/phpspreadsheet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.10.0

Affected versions

4.*
4.0.0
4.1.0
4.2.0
4.3.0
4.3.1
4.4.0
4.5.0
5.*
5.0.0
5.1.0
5.2.0
5.3.0
5.4.0
5.5.0
5.6.0
5.7.0
5.8.0
5.8.1
5.9.0

Database specific

last_known_affected_version_range 
"<= 5.9.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-j2w7-387v-m2rq/GHSA-j2w7-387v-m2rq.json"
phpoffice/phpspreadsheet

Package

Name
phpoffice/phpspreadsheet
Purl
pkg:composer/phpoffice/phpspreadsheet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.3.0
Fixed
3.10.8

Affected versions

3.*
3.3.0
3.4.0
3.5.0
3.6.0
3.7.0
3.8.0
3.9.0
3.9.1
3.9.2
3.9.3
3.10.0
3.10.1
3.10.2
3.10.3
3.10.4
3.10.5
3.10.6
3.10.7

Database specific

last_known_affected_version_range 
"<= 3.10.7"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-j2w7-387v-m2rq/GHSA-j2w7-387v-m2rq.json"
phpoffice/phpspreadsheet

Package

Name
phpoffice/phpspreadsheet
Purl
pkg:composer/phpoffice/phpspreadsheet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.2.0
Fixed
2.4.8

Affected versions

2.*
2.2.0
2.2.1
2.2.2
2.3.0
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.9
2.3.10
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7

Database specific

last_known_affected_version_range 
"<= 2.4.7"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-j2w7-387v-m2rq/GHSA-j2w7-387v-m2rq.json"
phpoffice/phpspreadsheet

Package

Name
phpoffice/phpspreadsheet
Purl
pkg:composer/phpoffice/phpspreadsheet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.19

Affected versions

2.*
2.0.0
2.1.0
2.1.1
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.1.10
2.1.11
2.1.12
2.1.13
2.1.14
2.1.15
2.1.16
2.1.17
2.1.18

Database specific

last_known_affected_version_range 
"<= 2.1.18"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-j2w7-387v-m2rq/GHSA-j2w7-387v-m2rq.json"
phpoffice/phpspreadsheet

Package

Name
phpoffice/phpspreadsheet
Purl
pkg:composer/phpoffice/phpspreadsheet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.30.7

Affected versions

1.*
1.0.0-beta
1.0.0-beta2
1.0.0
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.8.0
1.8.1
1.8.2
1.9.0
1.10.0
1.10.1
1.11.0
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.17.1
1.18.0
1.19.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.24.1
1.25.0
1.25.1
1.25.2
1.26.0
1.27.0
1.27.1
1.28.0
1.29.0
1.29.1
1.29.2
1.29.4
1.29.5
1.29.6
1.29.7
1.29.8
1.29.9
1.29.10
1.29.11
1.29.12
1.30.0
1.30.1
1.30.2
1.30.3
1.30.4
1.30.5
1.30.6

Database specific

last_known_affected_version_range 
"<= 1.30.6"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-j2w7-387v-m2rq/GHSA-j2w7-387v-m2rq.json"