pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long
    runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can
    craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by
    omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict
    reading mode is affected. This issue has been patched in version 6.6.0. (CVE-2026-22690)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long     runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can     craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by     omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict     reading mode is affected. This issue has been patched in version 6.6.0. (CVE-2026-22690)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
436671	SCA: security update for pypdf (GHSA-4xc4-762w-m6cg)	Tenable Cloud Security	SCA Checks	medium
436671	SCA: security update for pypdf (GHSA-4xc4-762w-m6cg)	Tenable Self-Hosted Container Security	SCA Checks	medium
282554	Linux Distros Unpatched Vulnerability : CVE-2026-22690	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-22690

medium

Tenable Plugins

medium

medium

medium