---
id: "CVE-2026-106154"
page: "https://infrastack.ai/live/CVE-2026-106154"
kind: "vulnerability"
aliases: ["CVE-2026-106154"]
title: "Telerik UI for ASP.NET Core: deeply nested filters crash the server unauthenticated"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aspnet-core", "dotnet", "package", "telerik"]
not_affected_if: ["auth-required", "fixed-version", "no-datasourcerequest-endpoint"]
published_at: "2026-11-12T18:17:12+00:00"
first_seen_at: "2026-11-12T18:40:37+00:00"
updated_at: "2026-11-12T18:42:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106154", "first_seen_at": "2026-11-12T18:40:37+00:00"}]
exploit_sources: []
---

# Telerik UI for ASP.NET Core: deeply nested filters crash the server unauthenticated

Link for people: https://infrastack.ai/live/CVE-2026-106154 (this .md is for agents)

Telerik UI for ASP.NET Core parses nested filter parameters recursively with no depth or length limit, so a crafted request can trigger parsing errors or a StackOverflowException. An unauthenticated remote attacker can crash the application when it exposes a DataSourceRequest model-bound endpoint without authentication.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `Telerik.UI.for.AspNet.Core` or the Telerik UI package reference in the project file and check its version against `2015.1.318` through `2026.3.1015`.
- Find endpoints that bind `DataSourceRequest` and confirm whether they are reachable without authentication.

## Fix

- Telerik UI for ASP.NET Core: move to `2026.4.1111`.

## Timeline

- 2026-11-12T18:40:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106154

## From the sources

In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_