Server-Side Resource Consumption in Telerik UI for ASP.NET Core
CVE-2026-106156

8.6HIGH

Key Information:

Vendor

Progress Software
Status
Telerik Ui For Asp.net Core
Vendor
CVE Published:
11 November 2026

What is CVE-2026-106156?

In Telerik UI for ASP.NET Core, versions 2015.1.318 through 2026.3.811, an attacker can exploit a server-side issue by sending repeated aggregation requests to unauthenticated aggregation endpoints. This leads to dynamic assemblies and load contexts being retained, resulting in excessive memory consumption. The exploit can progressively exhaust system resources, potentially degrading application availability. Disabling grouping in the client-side interface does not safeguard against these directed requests, thereby necessitating an immediate upgrade to version 2026.3.1015 to mitigate this risk.

Affected Version(s)

Telerik UI for ASP.NET Core 2015.1.318 < 2026.3.1015

References

https://www.telerik.com/aspnet-core-ui/documentation/know...
vendor-advisory

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.