{"id":"CVE-2026-106154","kind":"vulnerability","aliases":["CVE-2026-106154"],"related":[],"title":"Telerik UI for ASP.NET Core: deeply nested filters crash the server unauthenticated","description":"In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.","summary":"Telerik UI for ASP.NET Core parses nested filter parameters recursively with no depth or length limit, so a crafted request can trigger parsing errors or a StackOverflowException. An unauthenticated remote attacker can crash the application when it exposes a DataSourceRequest model-bound endpoint without authentication.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aspnet-core","dotnet","package","telerik"],"not_affected_if":["auth-required","fixed-version","no-datasourcerequest-endpoint"],"how_to_check":"- Look for `Telerik.UI.for.AspNet.Core` or the Telerik UI package reference in the project file and check its version against `2015.1.318` through `2026.3.1015`.\n- Find endpoints that bind `DataSourceRequest` and confirm whether they are reachable without authentication.","fix":"- Telerik UI for ASP.NET Core: move to `2026.4.1111`.","status":"open","published_at":"2026-11-12T18:17:12+00:00","first_seen_at":"2026-11-12T18:40:37+00:00","triaged_at":"2026-11-12T18:42:41+00:00","updated_at":"2026-11-12T18:42:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T18:42:41Z","model":"claude-haiku-5-5","output":{"fix":"- Telerik UI for ASP.NET Core: move to `2026.4.1111`.","reach":"internet","title":"Telerik UI for ASP.NET Core: deeply nested filters crash the server unauthenticated","impact":"medium","summary":"Telerik UI for ASP.NET Core parses nested filter parameters recursively with no depth or length limit, so a crafted request can trigger parsing errors or a StackOverflowException. An unauthenticated remote attacker can crash the application when it exposes a DataSourceRequest model-bound endpoint without authentication.","audience":"developers","category":"package","nicknames":[],"who_cares":["aspnet-core","telerik","dotnet"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Server process crashes via stack overflow from crafted filter input","analyst_note":"","how_to_check":"- Look for `Telerik.UI.for.AspNet.Core` or the Telerik UI package reference in the project file and check its version against `2015.1.318` through `2026.3.1015`.\n- Find endpoints that bind `DataSourceRequest` and confirm whether they are reachable without authentication.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","no-datasourcerequest-endpoint","fixed-version"],"who_is_affected":"Applications built on Telerik UI for ASP.NET Core in the affected version range that expose an endpoint using DataSourceRequest model binding without authentication. Applications that require login on those endpoints, or that do not use DataSourceRequest model binding, are not exposed to the described path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000766,"input_tokens":4675,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-106154':15A,18A '-2026':14A,17A '2015.1.318':79C '2026.3.1015':81C '2026.4.1111':154C 'applic':59B,122C 'asp.net':4A,28B,76C 'aspnet':20B 'aspnet-cor':19B 'attack':55B,116C 'authent':70B,134C 'bind':129C,144C 'bound':67B 'caus':146C 'core':5A,21B,29B,77C 'craft':43B 'crash':9A,57B 'cve':13A,16A 'datasourcerequest':64B,127C 'deepli':6A,135C 'depth':37B,101C 'dotnet':22B 'endpoint':68B,125C 'enforc':107C 'error':48B,141C 'exploit':118C 'expos':62B,123C 'express':89C 'filter':8A,32B,92C,137C 'filterlex':104C 'filterpars':86C 'fix':151C 'input':110C 'input-length':109C 'issu':149C 'length':39B,111C 'limit':40B,102C,112C 'model':66B,128C,143C 'model-bound':65B 'nest':7A,31B,88C,136C 'packag':23B 'paramet':33B,93C 'pars':30B,47B,96C,140C 'process':87C 'progress':72C 'reachabl':132C 'recurs':34B,95C,100C 'recursion-depth':99C 'remot':54B,115C 'request':44B 'server':11A,84C 'server-sid':83C 'side':85C 'stackoverflowexcept':51B,147C 'telerik':1A,24B,25B,73C 'trigger':46B,139C 'ui':2A,26B,74C 'unauthent':12A,53B,114C 'untrust':91C 'use':126C 'version':78C,153C 'without':69B,97C,133C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Telerik UI for ASP.NET Core in the affected version range that expose an endpoint using DataSourceRequest model binding without authentication. Applications that require login on those endpoints, or that do not use DataSourceRequest model binding, are not exposed to the described path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aspnetcore","dotnet","high","package","telerik"],"campaign_type":null,"search_a":"'-106154':15A,18A '-2026':14A,17A 'asp.net':4A 'core':5A 'crash':9A 'cve':13A,16A 'deepli':6A 'filter':8A 'nest':7A 'server':11A 'telerik':1A 'ui':2A 'unauthent':12A","search_b":"'applic':59B 'asp.net':28B 'aspnet':20B 'aspnet-cor':19B 'attack':55B 'authent':70B 'bound':67B 'core':21B,29B 'craft':43B 'crash':57B 'datasourcerequest':64B 'depth':37B 'dotnet':22B 'endpoint':68B 'error':48B 'expos':62B 'filter':32B 'length':39B 'limit':40B 'model':66B 'model-bound':65B 'nest':31B 'packag':23B 'paramet':33B 'pars':30B,47B 'recurs':34B 'remot':54B 'request':44B 'stackoverflowexcept':51B 'telerik':24B,25B 'trigger':46B 'ui':26B 'unauthent':53B 'without':69B","search_c":"'2015.1.318':79C '2026.3.1015':81C '2026.4.1111':154C 'applic':122C 'asp.net':76C 'attack':116C 'authent':134C 'bind':129C,144C 'caus':146C 'core':77C 'datasourcerequest':127C 'deepli':135C 'depth':101C 'endpoint':125C 'enforc':107C 'error':141C 'exploit':118C 'expos':123C 'express':89C 'filter':92C,137C 'filterlex':104C 'filterpars':86C 'fix':151C 'input':110C 'input-length':109C 'issu':149C 'length':111C 'limit':102C,112C 'model':128C,143C 'nest':88C,136C 'paramet':93C 'pars':96C,140C 'process':87C 'progress':72C 'reachabl':132C 'recurs':95C,100C 'recursion-depth':99C 'remot':115C 'server':84C 'server-sid':83C 'side':85C 'stackoverflowexcept':147C 'telerik':73C 'trigger':139C 'ui':74C 'unauthent':114C 'untrust':91C 'use':126C 'version':78C,153C 'without':97C,133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106154","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106154","severity":null,"published_at":"2026-11-12T18:17:12+00:00","modified_at":"2026-11-12T18:17:12+00:00","first_seen_at":"2026-11-12T18:40:37+00:00","fetched_at":"2026-11-12T18:40:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}