Skip to content
Threat Feed
Subscribe

Product

PhpSpreadsheet (>= 3.3.0, <= 3.10.6)

1 brief RSS
medium advisory

PhpSpreadsheet Gnumeric Reader Unbounded Gzip Expansion Leads to Denial of Service

The PhpOffice PhpSpreadsheet library is vulnerable to a denial of service (DoS) attack, identified as CVE-2026-59932, where its Gnumeric reader processes attacker-supplied `.gnumeric` files containing gzipped content without enforcing a decompressed-size limit, causing memory exhaustion and application crashes.

PhpSpreadsheet +4 denial-of-service vulnerability php ghsa software-supply-chain
1t