pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive work and memory use. This issue is fixed in version 6.21.3.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time
    and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares
    a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated
    declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive
    work and memory use. This issue is fixed in version 6.21.3. (CVE-2026-119208)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time     and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares     a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated     declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive     work and memory use. This issue is fixed in version 6.21.3. (CVE-2026-119208)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478086	SCA: security update for pypdf (GHSA-62m5-6wh8-28x7)	Tenable Cloud Security	SCA Checks	Local	high
478086	SCA: security update for pypdf (GHSA-62m5-6wh8-28x7)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
374233	Linux Distros Unpatched Vulnerability : CVE-2026-119208	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-119208

high

Tenable Plugins

high

high

high