CVE-2026-106137 · Package
NO FIX YET · SEE WHAT TO DO
Telerik UI for ASP.NET MVC builds dynamic classes in a shared dictionary without safe locking, and the dictionary can be corrupted or exhausted by crafted requests. An unauthenticated attacker can degrade availability and possibly corrupt server state through an open aggregation endpoint.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Telerik UI for ASP.NET MVC in the affected version range and expose an aggregation endpoint without authentication are exposed. Applications that do not use the affected version range, or that keep such endpoints behind authentication, are less exposed according to the description.
Not affected if auth-required, unaffected-version
Who cares asp.net, dotnet, telerik
2012.2.710 through 2026.3.8112026.3.1015In affected versions of Progress® Telerik® UI for ASP.NET MVC 2012.2.710 through 2026.3.811, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version 2026.3.1015.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.