CVE-2026-106156
Uncontrolled Resource Consumption in Telerik UI for ASP.NET Core Server-side Aggregation
In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`.
| CWE | CWE-400 |
| Vendor | progress software |
| Product | telerik ui for asp.net core |
| Published | Nov 11, 2026 |
Get instant alerts for progress software telerik ui for asp.net core
Be the first to know when new high vulnerabilities affecting progress software telerik ui for asp.net core are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H