CVE-2026-106156 · Package
NO FIX YET · SEE WHAT TO DO
Repeated server-side aggregation requests in Telerik UI for ASP.NET Core make dynamic assemblies and load contexts stay in memory, so process memory keeps growing. An unauthenticated remote attacker can exhaust resources and take the application down if an aggregation endpoint is reachable without login.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
ASP.NET Core applications that use Telerik UI for ASP.NET Core and expose a server-side aggregation endpoint without authentication are exposed. Disabling grouping in the client interface does not block direct requests with the same descriptors, so the server must be patched or the endpoint protected. Applications that require login for every data endpoint are less exposed.
Not affected if auth-required, versions-outside-range
Who cares asp.net-core, dotnet, nuget, telerik
.csproj) or with dotnet list package2015.1.318 through 2026.3.8112026.3.1015In Progress® Telerik® UI for ASP.NET Core versions 2015.1.318 through 2026.3.811, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version 2026.3.1015.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.