[HIGH] PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

PKSA-r22k-87hv-mfk4 CVE-2026-59933 GHSA-xh5m-36r6-47m3

Affected version: <=1.30.5|>=2.0.0,<=2.1.17|>=2.2.0,<=2.4.6|>=3.3.0,<=3.10.6|>=4.0.0,<=5.8.0

Reported by:
GitHub

[HIGH] PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

PKSA-m9cr-9614-rsf7 CVE-2026-59932 GHSA-2mrg-gjxq-2gvr

Affected version: <=1.30.5|>=2.0.0,<=2.1.17|>=2.2.0,<=2.4.6|>=3.3.0,<=3.10.6|>=4.0.0,<=5.8.0

Reported by:
GitHub

[HIGH] PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

PKSA-dqzt-yst9-1w9y CVE-2026-59931 GHSA-6hq5-7373-42rg

Affected version: <=1.30.5|>=2.0.0,<=2.1.17|>=2.2.0,<=2.4.6|>=3.3.0,<=3.10.6|>=4.0.0,<=5.8.0

Reported by:
GitHub

[CRITICAL] PHPSpreadsheet has a patch bypass for CVE-2026-34084

PKSA-x678-4z45-v3d5 CVE-2026-45034 GHSA-87m4-826x-3crx

Affected version: <=1.30.4

Reported by:
GitHub