Progress Telerik UI for ASP.NET Core: Denial of Service (CVE-2026-106154)
The FilterParser and FilterLexer components in Progress Telerik UI for ASP.NET Core are vulnerable to improper input handling, which can lead to parsing errors or StackOverflowException when processing deeply nested filter expressions provided by an unauthenticated remote attacker.
CVE search metadata
CVE search record: CVE-2026-106154. Severity: high. CVSS: 8.6. KEV: no. Product: Telerik UI for ASP.NET Core. Brief: Progress Telerik UI for ASP.NET Core: Denial of Service (CVE-2026-106154). Brief link: https://feed.craftedsignal.io/briefs/2026-11-telerik-ui-dos-cve-2026-106154/
Triage facts
Revision 1- Applicability
- Telerik UI for ASP.NET Core
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 18:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progress Telerik UI for ASP.NET Core contains a vulnerability in the server-side FilterParser, which processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, and in the FilterLexer, which does not enforce an input-length limit. An unauthenticated remote attacker can exploit this vulnerability if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause a StackOverflowException.
Impact
Exploitation can lead to parsing errors or a StackOverflowException within the application.
Recommendation
Applications using the DataSourceRequest model binding should review their authentication and input validation controls to prevent unauthorized access to these endpoints.