pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python operator precedence bug in pyzipper/zipfile_aes.py caused the AE-2 format to never be automatically selected during encryption, causing encrypted entries to be written in AE-1 format and exposing the plaintext CRC32 checksum in the ZIP header and, for unseekable zip archives, in the datadescripter section, allowing an attacker who possesses the archive to brute-force candidate plaintexts for small or low-entropy files by comparing CRC32 values. This issue is fixed in version 0.4.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to     0.4.0, a Python operator precedence bug in pyzipper/zipfile_aes.py caused the AE-2 format to never be     automatically selected during encryption, causing encrypted entries to be written in AE-1 format and     exposing the plaintext CRC32 checksum in the ZIP header and, for unseekable zip archives, in the     datadescripter section, allowing an attacker who possesses the archive to brute-force candidate plaintexts     for small or low-entropy files by comparing CRC32 values. This issue is fixed in version 0.4.0.
    (CVE-2026-44722)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to
    0.4.0, a Python operator precedence bug in pyzipper/zipfile_aes.py caused the AE-2 format to never be
    automatically selected during encryption, causing encrypted entries to be written in AE-1 format and
    exposing the plaintext CRC32 checksum in the ZIP header and, for unseekable zip archives, in the
    datadescripter section, allowing an attacker who possesses the archive to brute-force candidate plaintexts
    for small or low-entropy files by comparing CRC32 values. This issue is fixed in version 0.4.0.
    (CVE-2026-44722)

ID	Name	Product	Family	Severity
327790	Linux Distros Unpatched Vulnerability : CVE-2026-44722	Nessus	Misc.	medium
441876	SCA: security update for pyzipper (GHSA-crqm-m339-7m2p)	Tenable Cloud Security	SCA Checks	medium
441876	SCA: security update for pyzipper (GHSA-crqm-m339-7m2p)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-44722

medium

Tenable Plugins

medium

medium

medium