Progress Telerik UI for ASP.NET Core: Denial of Service via Memory Exhaustion (CVE-2026-106156)

Progress Telerik UI for ASP.NET Core versions 2015.1.318 through 2026.3.811 are vulnerable to a memory exhaustion flaw (CVE-2026-106156) caused by improper handling of server-side aggregation requests. When an application exposes an aggregation endpoint, an attacker can send repeated requests that cause the application to retain dynamic assemblies and load contexts in memory. This process accumulation can lead to significant memory growth, resulting in service instability or application unavailability. The vulnerability is exploitable by unauthenticated attackers, and client-side UI restrictions are ineffective against direct requests.

Impact

Exploitation can lead to resource exhaustion, resulting in the denial of service for the targeted web application.

Recommendation

• Upgrade Progress Telerik UI for ASP.NET Core to version 2026.3.1015 or later to resolve the memory leak.
• Identify applications utilizing vulnerable Telerik versions and temporarily restrict public access to aggregation-related endpoints if immediate patching is not possible.