CVE-2026-106156
HIGH
MEDIUM
Priority: 0.06
BB Relevance:
77/100
Published: 2026-11-11
Modified: 2026-11-12
First seen: 2026-11-11
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Changed
C:
None
I:
None
A:
High
Description
In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| Progress Software | Telerik UI for ASP.NET Core | 2015.1.318 < 2026.3.1015 |
References & Advisories (1)
vendor-advisory