{"id":"CVE-2026-106156","kind":"vulnerability","aliases":["CVE-2026-106156"],"related":[],"title":"Telerik UI for ASP.NET Core: repeated aggregation requests exhaust server memory","description":"In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`.","summary":"Repeated server-side aggregation requests in Telerik UI for ASP.NET Core make dynamic assemblies and load contexts stay in memory, so process memory keeps growing. An unauthenticated remote attacker can exhaust resources and take the application down if an aggregation endpoint is reachable without login.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asp.net-core","dotnet","nuget","package","telerik"],"not_affected_if":["auth-required","versions-outside-range"],"how_to_check":"- Check the Telerik.UI.for.AspNet.Core package version in the project file (`.csproj`) or with `dotnet list package`\n- Look for exposed Telerik data aggregation endpoints reachable without authentication\n- Versions affected: `2015.1.318` through `2026.3.811`","fix":"- Telerik UI for ASP.NET Core: move to `2026.3.1015`","status":"open","published_at":"2026-11-11T18:18:24+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","triaged_at":"2026-11-11T18:29:20+00:00","updated_at":"2026-11-11T18:29:20+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T18:29:20Z","model":"claude-haiku-5-5","output":{"fix":"- Telerik UI for ASP.NET Core: move to `2026.3.1015`","reach":"internet","title":"Telerik UI for ASP.NET Core: repeated aggregation requests exhaust server memory","impact":"medium","summary":"Repeated server-side aggregation requests in Telerik UI for ASP.NET Core make dynamic assemblies and load contexts stay in memory, so process memory keeps growing. An unauthenticated remote attacker can exhaust resources and take the application down if an aggregation endpoint is reachable without login.","audience":"developers","category":"package","nicknames":[],"who_cares":["asp.net-core","telerik","dotnet","nuget"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Memory exhaustion makes the application unavailable to all users","analyst_note":"","how_to_check":"- Check the Telerik.UI.for.AspNet.Core package version in the project file (`.csproj`) or with `dotnet list package`\n- Look for exposed Telerik data aggregation endpoints reachable without authentication\n- Versions affected: `2015.1.318` through `2026.3.811`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["versions-outside-range","auth-required"],"who_is_affected":"ASP.NET Core applications that use Telerik UI for ASP.NET Core and expose a server-side aggregation endpoint without authentication are exposed. Disabling grouping in the client interface does not block direct requests with the same descriptors, so the server must be patched or the endpoint protected. Applications that require login for every data endpoint are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000777,"input_tokens":4680,"output_tokens":619,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-106156':14A,17A '-2026':13A,16A '2015.1.318':78C '2026.3.1015':162C '2026.3.811':80C 'accumul':102C 'affect':137C 'aggreg':7A,28B,64B,85C,118C 'applic':60B,115C,138C 'asp.net':4A,18B,34B,75C 'assembl':38B,93C 'attack':53B,109C 'authent':124C 'avail':134C,139C 'caus':91C,128C 'client':145C 'client-sid':144C 'consumpt':105C 'contain':153C 'context':41B,96C 'core':5A,19B,35B,76C 'cve':12A,15A 'descriptor':155C 'direct':151C 'disabl':140C 'dotnet':20B 'dynam':37B,92C 'endpoint':65B,119C 'exhaust':9A,55B,133C 'exploit':111C 'expos':116C 'fix':159C 'group':90C,141C 'grow':49B 'growth':130C 'interfac':147C 'issu':157C 'keep':48B 'load':40B,95C 'login':69B 'make':36B 'may':132C 'memori':11A,44B,47B,104C,129C 'nuget':21B 'packag':22B 'prevent':150C 'process':46B,103C 'progress':71C 'reachabl':67B,122C 'remot':52B,108C 'repeat':6A,24B,81C,125C 'request':8A,29B,86C,126C,152C 'resourc':56B,135C 'result':100C 'retain':99C 'server':10A,26B,83C 'server-sid':25B,82C 'side':27B,84C,146C 'stay':42B 'take':58B 'telerik':1A,23B,31B,72C 'ui':2A,32B,73C 'unauthent':51B,107C 'version':77C,161C 'without':68B,89C,123C","nicknames":[],"mitigations":[],"who_affected":"ASP.NET Core applications that use Telerik UI for ASP.NET Core and expose a server-side aggregation endpoint without authentication are exposed. Disabling grouping in the client interface does not block direct requests with the same descriptors, so the server must be patched or the endpoint protected. Applications that require login for every data endpoint are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aspnetcore","dotnet","high","nuget","package","telerik"],"campaign_type":null,"search_a":"'-106156':14A,17A '-2026':13A,16A 'aggreg':7A 'asp.net':4A 'core':5A 'cve':12A,15A 'exhaust':9A 'memori':11A 'repeat':6A 'request':8A 'server':10A 'telerik':1A 'ui':2A","search_b":"'aggreg':28B,64B 'applic':60B 'asp.net':18B,34B 'assembl':38B 'attack':53B 'context':41B 'core':19B,35B 'dotnet':20B 'dynam':37B 'endpoint':65B 'exhaust':55B 'grow':49B 'keep':48B 'load':40B 'login':69B 'make':36B 'memori':44B,47B 'nuget':21B 'packag':22B 'process':46B 'reachabl':67B 'remot':52B 'repeat':24B 'request':29B 'resourc':56B 'server':26B 'server-sid':25B 'side':27B 'stay':42B 'take':58B 'telerik':23B,31B 'ui':32B 'unauthent':51B 'without':68B","search_c":"'2015.1.318':78C '2026.3.1015':162C '2026.3.811':80C 'accumul':102C 'affect':137C 'aggreg':85C,118C 'applic':115C,138C 'asp.net':75C 'assembl':93C 'attack':109C 'authent':124C 'avail':134C,139C 'caus':91C,128C 'client':145C 'client-sid':144C 'consumpt':105C 'contain':153C 'context':96C 'core':76C 'descriptor':155C 'direct':151C 'disabl':140C 'dynam':92C 'endpoint':119C 'exhaust':133C 'exploit':111C 'expos':116C 'fix':159C 'group':90C,141C 'growth':130C 'interfac':147C 'issu':157C 'load':95C 'may':132C 'memori':104C,129C 'prevent':150C 'process':103C 'progress':71C 'reachabl':122C 'remot':108C 'repeat':81C,125C 'request':86C,126C,152C 'resourc':135C 'result':100C 'retain':99C 'server':83C 'server-sid':82C 'side':84C,146C 'telerik':72C 'ui':73C 'unauthent':107C 'version':77C,161C 'without':89C,123C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106156","severity":null,"published_at":"2026-11-11T18:18:24+00:00","modified_at":"2026-11-11T18:18:24+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","fetched_at":"2026-11-11T18:28:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}