pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot upgrade yet, consider applying the changes from PR #3610 manually.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop
    vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop.
    This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot
    upgrade yet, consider applying the changes from PR #3610 manually. (CVE-2026-24688)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop     vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop.
    This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot     upgrade yet, consider applying the changes from PR #3610 manually. (CVE-2026-24688)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
437367	SCA: security update for pypdf (GHSA-2q4j-m29v-hq73)	Tenable Cloud Security	SCA Checks	medium
437367	SCA: security update for pypdf (GHSA-2q4j-m29v-hq73)	Tenable Self-Hosted Container Security	SCA Checks	medium
296930	Linux Distros Unpatched Vulnerability : CVE-2026-24688	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-24688

medium

Tenable Plugins

medium

medium

medium