UpHeron
All vulnerabilities

Packagist

CVE-2026-40902

PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

Severity
High 7.5
Published
29 Apr 2026
Last changed
13 May 2026
Added to UpHeron
22 Oct 2026
Fixed in
1.30.4, 2.1.16, 2.4.5, 3.10.5, 5.7.0
Also known as
GHSA-7c6m-4442-2x6m
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
phpoffice/phpspreadsheetPackagist · osv:Packagist:phpoffice/phpspreadsheet
  • Every version before 1.30.4
  • From 2.0.0 before 2.1.16
  • From 2.2.0 before 2.4.5
  • From 3.3.0 before 3.10.5
  • From 4.0.0 before 5.7.0

References