CVE-2022-44641: Debian Linux

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Linaro Lava: before 2022.11 (fixed in 2022.11)

Published 2022-11-18. Last modified 2026-06-17.