CVE-2026-106146 · Package
NO FIX YET · SEE WHAT TO DO
Telerik UI for ASP.NET MVC mishandles crafted server-side filter parameters, so unvalidated input throws uncaught casting and null-reference exceptions. The report describes HTTP 500 responses and does not show code execution or process termination.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications built on Telerik UI for ASP.NET MVC in the listed version range that expose an endpoint without authentication accepting filter parameters. Applications without such an endpoint, or running outside the affected range, are not exposed according to the report.
Not affected if auth-required, unaffected-version
Who cares asp.net, dotnet, telerik, web-apps
packages.config2026.4.1111 or later (affected range 2012.2.710 through 2026.3.1015)In Progress® Telerik® UI for ASP.NET MVC versions 2012.2.710 through 2026.3.1015, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated remote attacker can exploit this if the application exposes an endpoint reachable without authentication that accepts crafted filter parameters. Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and return HTTP 500. The report does not demonstrate worker-process termination or disruption of unrelated requests. The issue is fixed in version 2026.4.1111.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.