pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long
    runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to
    possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files
    with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only
    the non-strict reading mode is affected. This issue has been patched in version 6.6.0. (CVE-2026-22691)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long     runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to     possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files     with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only     the non-strict reading mode is affected. This issue has been patched in version 6.6.0. (CVE-2026-22691)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
436676	SCA: security update for pypdf (GHSA-4f6g-68pf-7vhv)	Tenable Cloud Security	SCA Checks	medium
436676	SCA: security update for pypdf (GHSA-4f6g-68pf-7vhv)	Tenable Self-Hosted Container Security	SCA Checks	medium
282555	Linux Distros Unpatched Vulnerability : CVE-2026-22691	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-22691

medium

Tenable Plugins

medium

medium

medium