CVE-2022-26662: Debian Linux

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Tryton Proteus: from 5.0.0, before 5.0.12 (fixed in 5.0.12); from 6.0.0, before 6.0.5 (fixed in 6.0.5); from 6.2.0, before 6.2.2 (fixed in 6.2.2)
• Tryton Trytond: from 5.0.0, before 5.0.46 (fixed in 5.0.46); from 6.0.0, before 6.0.16 (fixed in 6.0.16); from 6.2.0, before 6.2.6 (fixed in 6.2.6)

Published 2022-03-10. Last modified 2026-06-17.