Insecure Class Dictionary Management in Progress Telerik UI for ASP.NET MVC
CVE-2026-106137

8.6HIGH

Key Information:

Vendor

Progress Software
Status
Telerik Ui For Asp.net Mvc
Vendor
CVE Published:
11 November 2026

What is CVE-2026-106137?

The vulnerability in Progress Telerik UI for ASP.NET MVC versions from 2012.2.710 to 2026.3.811 is a flaw in the ClassFactory's handling of a shared class dictionary. This flaw allows unauthenticated attackers to exploit the absence of exclusive write protection, enabling them to perform concurrent or repeated crafted requests. Such actions may lead to the corruption of the dictionary state or overconsumption of CPU and memory resources, ultimately affecting application availability. The issue is resolved in version 2026.3.1015.

Affected Version(s)

Telerik UI for ASP.NET MVC 2012.2.710 < 2026.3.1015

References

https://www.telerik.com/aspnet-mvc/documentation/knowledg...
vendor-advisory

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.