{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aprogresstelerik_ui_for_asp_net_core/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progress:telerik_ui_for_asp_net_core:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-106156"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Telerik UI for ASP.NET Core (2015.1.318 - 2026.3.811)"],"_cs_severities":["low"],"_cs_tags":["cve-2026-106156","denial-of-service","web-application"],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eProgress Telerik UI for ASP.NET Core versions 2015.1.318 through 2026.3.811 are vulnerable to a memory exhaustion flaw (CVE-2026-106156) caused by improper handling of server-side aggregation requests. When an application exposes an aggregation endpoint, an attacker can send repeated requests that cause the application to retain dynamic assemblies and load contexts in memory. This process accumulation can lead to significant memory growth, resulting in service instability or application unavailability. The vulnerability is exploitable by unauthenticated attackers, and client-side UI restrictions are ineffective against direct requests.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eExploitation can lead to resource exhaustion, resulting in the denial of service for the targeted web application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Progress Telerik UI for ASP.NET Core to version 2026.3.1015 or later to resolve the memory leak.\u003c/li\u003e\n\u003cli\u003eIdentify applications utilizing vulnerable Telerik versions and temporarily restrict public access to aggregation-related endpoints if immediate patching is not possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T20:06:46Z","date_published":"2026-11-11T20:06:46Z","id":"https://feed.craftedsignal.io/briefs/2026-11-telerik-memory-exhaustion-cve-2026-106156/","summary":"Progress Telerik UI for ASP.NET Core is vulnerable to a denial-of-service condition where unauthenticated remote requests trigger uncontrolled memory accumulation of dynamic assemblies.","title":"Progress Telerik UI for ASP.NET Core: Denial of Service via Memory Exhaustion (CVE-2026-106156)","url":"https://feed.craftedsignal.io/briefs/2026-11-telerik-memory-exhaustion-cve-2026-106156/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:progress:telerik_ui_for_asp_net_core:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}