---
id: "CVE-2026-106156"
page: "https://infrastack.ai/live/CVE-2026-106156"
kind: "vulnerability"
aliases: ["CVE-2026-106156"]
title: "Telerik UI for ASP.NET Core: repeated aggregation requests exhaust server memory"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["asp.net-core", "dotnet", "nuget", "package", "telerik"]
not_affected_if: ["auth-required", "versions-outside-range"]
published_at: "2026-11-11T18:18:24+00:00"
first_seen_at: "2026-11-11T18:28:42+00:00"
updated_at: "2026-11-11T18:29:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106156", "first_seen_at": "2026-11-11T18:28:42+00:00"}]
exploit_sources: []
---

# Telerik UI for ASP.NET Core: repeated aggregation requests exhaust server memory

Link for people: https://infrastack.ai/live/CVE-2026-106156 (this .md is for agents)

Repeated server-side aggregation requests in Telerik UI for ASP.NET Core make dynamic assemblies and load contexts stay in memory, so process memory keeps growing. An unauthenticated remote attacker can exhaust resources and take the application down if an aggregation endpoint is reachable without login.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Telerik.UI.for.AspNet.Core package version in the project file (`.csproj`) or with `dotnet list package`
- Look for exposed Telerik data aggregation endpoints reachable without authentication
- Versions affected: `2015.1.318` through `2026.3.811`

## Fix

- Telerik UI for ASP.NET Core: move to `2026.3.1015`

## Timeline

- 2026-11-11T18:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106156

## From the sources

In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_