{"id":"CVE-2026-106137","kind":"vulnerability","aliases":["CVE-2026-106137"],"related":[],"title":"Telerik UI for ASP.NET MVC: concurrent requests corrupt shared state, degrade availability","description":"In affected versions of Progress® Telerik® UI for ASP.NET MVC `2012.2.710` through `2026.3.811`, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version `2026.3.1015`.","summary":"Telerik UI for ASP.NET MVC builds dynamic classes in a shared dictionary without safe locking, and the dictionary can be corrupted or exhausted by crafted requests. An unauthenticated attacker can degrade availability and possibly corrupt server state through an open aggregation endpoint.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asp.net","dotnet","package","telerik"],"not_affected_if":["auth-required","unaffected-version"],"how_to_check":"- Check the Telerik UI for ASP.NET MVC package version in the project's packages.config or .csproj against `2012.2.710` through `2026.3.811`\n- Look for an aggregation endpoint reachable without authentication in the application","fix":"- Telerik UI for ASP.NET MVC: move to `2026.3.1015`","status":"open","published_at":"2026-11-11T18:18:24+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","triaged_at":"2026-11-11T18:29:23+00:00","updated_at":"2026-11-11T18:29:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T18:29:23Z","model":"claude-haiku-5-5","output":{"fix":"- Telerik UI for ASP.NET MVC: move to `2026.3.1015`","reach":"internet","title":"Telerik UI for ASP.NET MVC: concurrent requests corrupt shared state, degrade availability","impact":"medium","summary":"Telerik UI for ASP.NET MVC builds dynamic classes in a shared dictionary without safe locking, and the dictionary can be corrupted or exhausted by crafted requests. An unauthenticated attacker can degrade availability and possibly corrupt server state through an open aggregation endpoint.","audience":"businesses","category":"package","nicknames":[],"who_cares":["asp.net","telerik","dotnet"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"server availability degraded; shared state possibly corrupted","analyst_note":"","how_to_check":"- Check the Telerik UI for ASP.NET MVC package version in the project's packages.config or .csproj against `2012.2.710` through `2026.3.811`\n- Look for an aggregation endpoint reachable without authentication in the application","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","unaffected-version"],"who_is_affected":"Applications that use Telerik UI for ASP.NET MVC in the affected version range and expose an aggregation endpoint without authentication are exposed. Applications that do not use the affected version range, or that keep such endpoints behind authentication, are less exposed according to the description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4737,"output_tokens":551,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-106137':15A,18A '-2026':14A,17A '2012.2.710':75C '2026.3.1015':177C '2026.3.811':77C 'affect':66C 'aggreg':63B,115C,142C 'appdomain':100C 'applic':139C 'asp.net':4A,19B,26B,73C 'assembl':94C 'atom':110C 'attack':51B,133C 'authent':148C 'avail':12A,54B,170C 'build':28B 'case':112C,128C 'case-insensit':127C 'class':30B,82C 'classfactori':78C 'collect':92C 'concurr':6A,151C 'corrupt':8A,43B,57B,159C 'cpu':164C 'craft':47B,154C 'cve':13A,16A 'degrad':11A,53B,169C 'descriptor':116C 'dictionari':34B,40B,83C,104C,160C 'distinct':119C 'dotnet':20B 'dynam':29B,93C 'emit':89C 'endpoint':64B,143C 'even':122C 'exclus':85C 'exhaust':45B 'exploit':135C 'expos':140C 'fix':174C 'increas':163C 'insensit':129C 'insert':107C 'issu':172C 'lifetim':102C 'load':97C 'lock':37B 'lookup':105C 'may':158C 'member':124C 'memori':166C 'mvc':5A,27B,74C 'non':91C 'non-collect':90C 'open':62B 'packag':21B 'possibl':56B 'potenti':168C 'produc':118C 'progress':69C 'protect':87C 'reachabl':146C 'remain':96C 'remot':132C 'repeat':153C 'request':7A,48B,155C,157C 'resolut':125C 'retain':120C 'safe':36B 'server':58B 'share':9A,33B,81C 'state':10A,59B,161C 'submit':150C 'telerik':1A,22B,23B,70C 'though':123C 'type':121C 'ui':2A,24B,71C 'unauthent':50B,131C 'updat':79C 'use':167C 'variat':113C 'version':67C,176C 'without':35B,84C,147C 'write':86C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Telerik UI for ASP.NET MVC in the affected version range and expose an aggregation endpoint without authentication are exposed. Applications that do not use the affected version range, or that keep such endpoints behind authentication, are less exposed according to the description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aspnet","dotnet","high","package","telerik"],"campaign_type":null,"search_a":"'-106137':15A,18A '-2026':14A,17A 'asp.net':4A 'avail':12A 'concurr':6A 'corrupt':8A 'cve':13A,16A 'degrad':11A 'mvc':5A 'request':7A 'share':9A 'state':10A 'telerik':1A 'ui':2A","search_b":"'aggreg':63B 'asp.net':19B,26B 'attack':51B 'avail':54B 'build':28B 'class':30B 'corrupt':43B,57B 'craft':47B 'degrad':53B 'dictionari':34B,40B 'dotnet':20B 'dynam':29B 'endpoint':64B 'exhaust':45B 'lock':37B 'mvc':27B 'open':62B 'packag':21B 'possibl':56B 'request':48B 'safe':36B 'server':58B 'share':33B 'state':59B 'telerik':22B,23B 'ui':24B 'unauthent':50B 'without':35B","search_c":"'2012.2.710':75C '2026.3.1015':177C '2026.3.811':77C 'affect':66C 'aggreg':115C,142C 'appdomain':100C 'applic':139C 'asp.net':73C 'assembl':94C 'atom':110C 'attack':133C 'authent':148C 'avail':170C 'case':112C,128C 'case-insensit':127C 'class':82C 'classfactori':78C 'collect':92C 'concurr':151C 'corrupt':159C 'cpu':164C 'craft':154C 'degrad':169C 'descriptor':116C 'dictionari':83C,104C,160C 'distinct':119C 'dynam':93C 'emit':89C 'endpoint':143C 'even':122C 'exclus':85C 'exploit':135C 'expos':140C 'fix':174C 'increas':163C 'insensit':129C 'insert':107C 'issu':172C 'lifetim':102C 'load':97C 'lookup':105C 'may':158C 'member':124C 'memori':166C 'mvc':74C 'non':91C 'non-collect':90C 'potenti':168C 'produc':118C 'progress':69C 'protect':87C 'reachabl':146C 'remain':96C 'remot':132C 'repeat':153C 'request':155C,157C 'resolut':125C 'retain':120C 'share':81C 'state':161C 'submit':150C 'telerik':70C 'though':123C 'type':121C 'ui':71C 'unauthent':131C 'updat':79C 'use':167C 'variat':113C 'version':67C,176C 'without':84C,147C 'write':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106137","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106137","severity":null,"published_at":"2026-11-11T18:18:24+00:00","modified_at":"2026-11-11T18:18:24+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","fetched_at":"2026-11-11T18:28:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}