pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a
    partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient
    byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully
    decode, causing long runtimes and application unavailability. This is a residual issue after the malformed
    FlateDecode recovery fix. This issue is fixed in version 6.18.1. (CVE-2026-102997)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a     partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient     byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully     decode, causing long runtimes and application unavailability. This is a residual issue after the malformed     FlateDecode recovery fix. This issue is fixed in version 6.18.1. (CVE-2026-102997)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
471624	Echo: pypdf: security update to 6.18.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
471624	Echo: pypdf: security update to 6.18.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
471231	Chainguard: multiple open-webui packages: security update to 0.11.4-r3	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
471231	Chainguard: multiple open-webui packages: security update to 0.11.4-r3	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
455129	SCA: security update for pypdf (GHSA-jw7q-gvrg-4vj3)	Tenable Cloud Security	SCA Checks	Local	high
455129	SCA: security update for pypdf (GHSA-jw7q-gvrg-4vj3)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
359502	Linux Distros Unpatched Vulnerability : CVE-2026-102997	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-102997

high

Tenable Plugins

high

high

high

high

high

high

high