---
id: "CVE-2026-106137"
page: "https://infrastack.ai/live/CVE-2026-106137"
kind: "vulnerability"
aliases: ["CVE-2026-106137"]
title: "Telerik UI for ASP.NET MVC: concurrent requests corrupt shared state, degrade availability"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["asp.net", "dotnet", "package", "telerik"]
not_affected_if: ["auth-required", "unaffected-version"]
published_at: "2026-11-11T18:18:24+00:00"
first_seen_at: "2026-11-11T18:28:42+00:00"
updated_at: "2026-11-11T18:29:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106137", "first_seen_at": "2026-11-11T18:28:42+00:00"}]
exploit_sources: []
---

# Telerik UI for ASP.NET MVC: concurrent requests corrupt shared state, degrade availability

Link for people: https://infrastack.ai/live/CVE-2026-106137 (this .md is for agents)

Telerik UI for ASP.NET MVC builds dynamic classes in a shared dictionary without safe locking, and the dictionary can be corrupted or exhausted by crafted requests. An unauthenticated attacker can degrade availability and possibly corrupt server state through an open aggregation endpoint.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Telerik UI for ASP.NET MVC package version in the project's packages.config or .csproj against `2012.2.710` through `2026.3.811`
- Look for an aggregation endpoint reachable without authentication in the application

## Fix

- Telerik UI for ASP.NET MVC: move to `2026.3.1015`

## Timeline

- 2026-11-11T18:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106137

## From the sources

In affected versions of Progress® Telerik® UI for ASP.NET MVC `2012.2.710` through `2026.3.811`, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version `2026.3.1015`.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_