CVE-2026-106154 · Package
NO FIX YET · SEE WHAT TO DO
Telerik UI for ASP.NET Core parses nested filter parameters recursively with no depth or length limit, so a crafted request can trigger parsing errors or a StackOverflowException. An unauthenticated remote attacker can crash the application when it exposes a DataSourceRequest model-bound endpoint without authentication.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications built on Telerik UI for ASP.NET Core in the affected version range that expose an endpoint using DataSourceRequest model binding without authentication. Applications that require login on those endpoints, or that do not use DataSourceRequest model binding, are not exposed to the described path.
Not affected if auth-required, fixed-version, no-datasourcerequest-endpoint
Who cares aspnet-core, dotnet, telerik
Telerik.UI.for.AspNet.Core or the Telerik UI package reference in the project file and check its version against 2015.1.318 through 2026.3.1015.DataSourceRequest and confirm whether they are reachable without authentication.2026.4.1111.In Progress® Telerik® UI for ASP.NET Core versions 2015.1.318 through 2026.3.1015, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause StackOverflowException. This issue is fixed in version 2026.4.1111.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.