{"id":"CVE-2022-26662","aliases":["DEBIAN-CVE-2022-26662","DLA-2945-1","DLA-2946-1","DSA-5098-1","DSA-5099-1","EUVD-2022-0343","GHSA-pm3h-mm62-pwm8","PYSEC-2022-43171","PYSEC-2026-3392","PYSEC-2026-741","UBUNTU-CVE-2022-26662"],"status":"published","title":"XML Entity Expansion in trytond and proteus","description":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01973,"percentile":0.80703,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-776"],"published":"2022-03-07T22:40:00Z","modified":"2026-11-03T06:01:49Z","fixes":[{"ecosystem":"PyPI","package":"trytond","fixed_in":["5.0.46","6.0.16","6.2.6"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"proteus","fixed_in":["5.0.12","6.0.5","6.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"tryton-proteus","fixed_in":["6.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tryton-proteus","fixed_in":["6.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tryton-proteus","fixed_in":["6.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tryton-server","fixed_in":["6.0.16-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tryton-server","fixed_in":["6.0.16-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tryton-server","fixed_in":["6.0.16-1"],"sources":["osv"]},{"ecosystem":"PyPI","package":"tryton","fixed_in":["5.0.12","6.0.5","6.2.2","6.2.6","6.0.16","5.0.46"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.46"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.16"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.2.6"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.12"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.5"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.2.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.16-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.16-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.16-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-2+deb9u2"}]}],"versions":["4.2.1-2","4.2.1-2+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-1+deb9u1"}]}],"versions":["4.2.0-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4-2+deb10u1"}]}],"versions":["5.0.4-2"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.33-2+deb11u1"}]}],"versions":["5.0.33-2"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-3+deb10u1"}]}],"versions":["5.0.1-3"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.8-1+deb11u1"}]}],"versions":["5.0.8-1"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.46"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.15","5.0.16","5.0.17","5.0.18","5.0.19","5.0.2","5.0.20","5.0.21","5.0.22","5.0.23","5.0.24","5.0.25","5.0.26","5.0.27","5.0.28","5.0.29","5.0.3","5.0.30","5.0.31","5.0.32","5.0.33","5.0.34","5.0.35","5.0.36","5.0.37","5.0.38","5.0.39","5.0.4","5.0.40","5.0.41","5.0.42","5.0.43","5.0.44","5.0.45","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.16"}]}],"versions":["6.0.0","6.0.1","6.0.10","6.0.11","6.0.12","6.0.13","6.0.14","6.0.15","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.2.6"}]}],"versions":["6.2.0","6.2.1","6.2.2","6.2.3","6.2.4","6.2.5"]},{"source":"osv","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.12"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.5"}]}],"versions":["6.0.0","6.0.1","6.0.2","6.0.3","6.0.4"]},{"source":"osv","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.2.2"}]}],"versions":["6.2.0","6.2.1"]},{"source":"osv","ecosystem":"PyPI","package":"tryton","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.12"},{"introduced":"6.0.0"},{"fixed":"6.0.5"},{"introduced":"6.2.0"},{"fixed":"6.2.2"},{"fixed":"6.2.6"},{"fixed":"6.0.16"},{"fixed":"5.0.46"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","6.0.0","6.0.1","6.0.2","6.0.3","6.0.4","6.2.0","6.2.1"]},{"source":"osv","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.46"},{"introduced":"6.0.0"},{"fixed":"6.0.16"},{"introduced":"6.1.0"},{"fixed":"6.2.6"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.15","5.0.16","5.0.17","5.0.18","5.0.19","5.0.2","5.0.20","5.0.21","5.0.22","5.0.23","5.0.24","5.0.25","5.0.26","5.0.27","5.0.28","5.0.29","5.0.3","5.0.30","5.0.31","5.0.32","5.0.33","5.0.34","5.0.35","5.0.36","5.0.37","5.0.38","5.0.39","5.0.4","5.0.40","5.0.41","5.0.42","5.0.43","5.0.44","5.0.45","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","6.0.0","6.0.1","6.0.10","6.0.11","6.0.12","6.0.13","6.0.14","6.0.15","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.0.9","6.2.0","6.2.1","6.2.2","6.2.3","6.2.4","6.2.5"]},{"source":"osv","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.12"},{"introduced":"6.0.0"},{"fixed":"6.0.5"},{"introduced":"6.1.0"},{"fixed":"6.2.2"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","6.0.0","6.0.1","6.0.2","6.0.3","6.0.4","6.2.0","6.2.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.1-1","3.8.0-1","3.8.1-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-1","3.6.3-2","3.6.3-3","3.8.0-1","3.8.1-1","3.8.2-1","3.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-4","4.6.0-1","4.6.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-3","4.6.0-1","4.6.1-1","4.6.2-1","4.6.3-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.3-2","5.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.10-1","5.0.14-2","5.0.16-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.8-1","6.0.3-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.33-2","6.0.9-3","6.0.12-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.8-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.34-1","6.0.36-1","6.0.39-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.24-1","7.0.30-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.43-1","7.0.47-1","7.0.53-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.1-3","7.0.2-1","7.0.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.30-1","7.0.38-1","7.0.40-1","7.0.43-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"tryton","product":"proteus"},{"vendor":"tryton","product":"trytond"}],"references":[{"url":"https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web","advisory","report"]},{"url":"https://bugs.tryton.org/issue11244","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","web","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://www.debian.org/security/2022/dsa-5098","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2022/dsa-5099","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26662","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pm3h-mm62-pwm8","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26662.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-26662","tags":["advisory"]},{"url":"https://hg.tryton.org/trytond","tags":["package"]},{"url":"https://pypi.org/project/trytond","tags":["package"]},{"url":"https://pypi.org/project/proteus","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-26662","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26662","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-26662","description":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.","status":"published","published":"2022-03-07T22:40:00Z","modified":"2024-08-03T05:11:44.228Z","updated_at":"2026-11-02T14:34:25.954329Z"}],"euvd":[{"id":"EUVD-2022-0343","description":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.","status":"published","published":"2022-03-07T22:40:00Z","modified":"2024-08-03T05:11:44Z","updated_at":"2026-11-03T03:25:44.694159Z"}],"ghsa":[{"id":"GHSA-pm3h-mm62-pwm8","title":"XML Entity Expansion in trytond and proteus","description":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.","status":"published","published":"2022-03-11T00:02:04Z","modified":"2023-02-03T05:06:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:36:44.093794Z"}],"nvd":[{"id":"CVE-2022-26662","description":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.","status":"published","published":"2022-03-10T17:47:52.56Z","modified":"2026-06-17T04:35:36.623Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:07:13.7085Z"}],"osv":[{"id":"GHSA-pm3h-mm62-pwm8","title":"XML Entity Expansion in trytond and proteus","description":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.","status":"published","published":"2022-03-11T00:02:04Z","modified":"2026-07-13T16:43:06.410889598Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"PYSEC-2022-43171","description":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.","status":"published","published":"2022-03-10T17:47:00Z","modified":"2026-07-13T16:43:06.410889598Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"PYSEC-2026-3392","title":"XML Entity Expansion in trytond and proteus","description":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.","status":"published","published":"2026-07-09T16:49:45.054237Z","modified":"2026-07-13T16:43:06.410889598Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"PYSEC-2026-741","title":"XML Entity Expansion in trytond and proteus","description":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.","status":"published","published":"2026-07-02T14:13:15.845785Z","modified":"2026-07-13T16:43:06.410889598Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"UBUNTU-CVE-2022-26662","description":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.","status":"published","published":"2022-03-10T17:47:00Z","modified":"2026-10-17T12:55:57.453247974Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"CVE-2022-26662","description":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.","status":"published","published":"2022-03-07T22:40:00Z","modified":"2026-10-28T02:30:21.066068404Z","updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"DEBIAN-CVE-2022-26662","description":"An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.","status":"published","published":"2022-03-10T17:47:52.56Z","modified":"2026-11-03T06:01:49.861614509Z","updated_at":"2026-11-03T06:44:26.638603Z"},{"id":"DLA-2945-1","title":"tryton-server - security update","status":"published","published":"2022-03-11T00:00:00Z","modified":"2026-03-09T01:20:35.608261Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-2946-1","title":"tryton-proteus - security update","status":"published","published":"2022-03-11T00:00:00Z","modified":"2026-03-09T01:21:54.156357Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5098-1","title":"tryton-server - security update","status":"published","published":"2022-03-10T00:00:00Z","modified":"2026-03-09T02:11:18.831979Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"DSA-5099-1","title":"tryton-proteus - security update","status":"published","published":"2022-03-10T00:00:00Z","modified":"2026-03-09T02:10:05.628637Z","updated_at":"2026-11-02T15:46:17.543497Z"}]}}