There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time
    and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares
    a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated
    declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive
    work and memory use. This issue is fixed in version 6.21.3. (CVE-2026-119208)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time     and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares     a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated     declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive     work and memory use. This issue is fixed in version 6.21.3. (CVE-2026-119208)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22219-1 advisory.

    Changes in python-pypdf:

    - CVE-2026-119209: negative /Index values and multiplied xref       streams can lead to clamp bypass and server memory exhaustion       (bsc#1288950)
    - CVE-2026-119208: trusting forged /Count values in encrypted PDF       page trees can lead to excessive resource consumption and denial       of service (bsc#1288951)
    - CVE-2026-119207: nested exception text accumulation in strict       mode parsing can lead to memory amplification and application       denial of service (bsc#1288952)
    - CVE-2026-119206: repeated sequential /Nums scanning in       page_labels resolution can lead to algorithmic complexity attacks       and denial of service (bsc#1288944)
    - CVE-2026-119205: misdirected reference tracking during dictionary       cloning can lead to cycle-detection bypass and thread-hanging       infinite loops (bsc#1288943)
    - CVE-2026-119204: unbounded resource entry copying during       page-tree flattening can lead to excessive memory allocation and       denial of service (bsc#1288942)
    - CVE-2026-119203: unterminated trailer search in incomplete       cross-reference tables can lead to an infinite loop and       thread-blocking denial of service (bsc#1288941)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
478142	Chainguard: multiple open-webui packages: security update to 0.12.3-r14	Tenable Cloud Security	Chainguard Local Security Checks	2026/11/1	2026/11/3	high
478086	SCA: security update for pypdf (GHSA-62m5-6wh8-28x7)	Tenable Cloud Security	SCA Checks	2026/10/31	2026/11/3	high
478086	SCA: security update for pypdf (GHSA-62m5-6wh8-28x7)	Tenable Self-Hosted Container Security	SCA Checks	2026/10/31	2026/11/3	high
478142	Chainguard: multiple open-webui packages: security update to 0.12.3-r14	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	2026/11/1	2026/11/3	high
374233	Linux Distros Unpatched Vulnerability : CVE-2026-119208	Nessus	Misc.	2026/10/30	2026/11/6	high
376242	openSUSE 16 Security Update : python-pypdf (openSUSE-SU-2026:22219-1)	Nessus	SuSE Local Security Checks	2026/11/5	2026/11/5	high

偵測

搜尋 Plugin

high

high

high

high

high

high