HighFix available
tryton-proteus, tryton-server — security advisory
An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
- Products
- tryton-proteus, tryton-server
- Affected versions
- Not specified
- Fixed versions
- 6.0.16-1, 6.0.5-1
- CVEs
- CVE-2022-26662
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:38 UTC · Revision 1
Source evidence
An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
osv:DEBIAN-CVE-2022-26662
tryton-proteus
Fixed versions: 6.0.5-1
tryton-proteus
Fixed versions: 6.0.5-1
tryton-proteus
Fixed versions: 6.0.5-1
tryton-server
Fixed versions: 6.0.16-1
tryton-server
Fixed versions: 6.0.16-1
tryton-server
Fixed versions: 6.0.16-1
Complete source record
{
"id": "9cc1ab75925613ea29d9fc5c28aafcc1f6988cfb41812bce475e6360bb6de99f",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-26662",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-26662",
"summary": "An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.",
"evidence": "osv:DEBIAN-CVE-2022-26662",
"products": [
{
"name": {
"value": "tryton-proteus",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.5-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tryton-proteus",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.5-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tryton-proteus",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.5-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tryton-server",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.16-1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tryton-server",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.16-1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tryton-server",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.16-1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2022-26662",
"aliases": [
"DEBIAN-CVE-2022-26662"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.5-1"
}
]
}
],
"package": {
"name": "tryton-proteus",
"purl": "pkg:deb/debian/tryton-proteus?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-26662.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.5-1"
}
]
}
],
"package": {
"name": "tryton-proteus",
"purl": "pkg:deb/debian/tryton-proteus?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-26662.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.5-1"
}
]
}
],
"package": {
"name": "tryton-proteus",
"purl": "pkg:deb/debian/tryton-proteus?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-26662.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.16-1"
}
]
}
],
"package": {
"name": "tryton-server",
"purl": "pkg:deb/debian/tryton-server?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-26662.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.16-1"
}
]
}
],
"package": {
"name": "tryton-server",
"purl": "pkg:deb/debian/tryton-server?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-26662.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.16-1"
}
]
}
],
"package": {
"name": "tryton-server",
"purl": "pkg:deb/debian/tryton-server?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-26662.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:01:09.468175562Z",
"provider": "osv",
"upstream": [
"CVE-2022-26662"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-26662"
]
},
"related_cves": [
{
"value": "CVE-2022-26662",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 322824,
"published_at": "2022-03-10T17:47:52.56+00:00"
}