Uncontrolled Recursion Vulnerability in Telerik UI for ASP.NET Core

CVE-2026-106154

What is CVE-2026-106154?

The Telerik UI for ASP.NET Core is susceptible to an uncontrolled recursion vulnerability due to the FilterParser processing nested expressions in untrusted filter parameters without a recursion-depth limitation. This weakness can be exploited by unauthenticated remote attackers if the application has accessible endpoints utilizing DataSourceRequest model binding. An attacker can send deeply nested filter expressions, which may produce parsing errors or result in a StackOverflowException during model binding. It is crucial for users to update to version 2026.4.1111 or later to mitigate this risk.

References