Telerik UI for ASP.NET MVC: Race condition and memory retention in ClassFactory
Summary
Telerik UI for ASP.NET MVC versions 2012.2.710 through 2026.3.811 contain a race condition in ClassFactory, which creates dynamic classes and assemblies for aggregate descriptors. Dynamic assemblies are not released, and the shared dictionary can be corrupted under concurrent requests. An unauthenticated remote attacker can exploit this only if the application exposes an aggregation endpoint without authentication, which may cause high CPU and memory use and degrade availability. The CNA rates the issue 8.6 (High); VulDB rates it 5.3 (Medium).
Affected
- Progress Telerik UI for ASP.NET MVC 2012.2.710 through 2026.3.811 (per CVE description)
- Builds between 2026.3.811 and 2026.3.1015 are not clearly covered by the sources: Unknown, check the vendor advisory
Fixed in
- Version 2026.3.1015 or later
Workaround
- No vendor workaround found.
- Until the upgrade, ensure aggregation endpoints are not reachable without authentication or proper access controls (based on a sibling product, CVE-2026-106156; verify for MVC).
- Consider rate limiting on affected endpoints.
Exploitation
- No known exploitation as of research; not listed in CISA KEV.
- No public proof of concept found for this CVE.
- VulDB tags the entry as 0-Day, which describes disclosure status, not confirmed attacks.
Our recommendation
- Inventory Telerik UI for ASP.NET MVC versions in all web applications.
- Upgrade to 2026.3.1015 or later at the next maintenance window; sooner for internet-facing applications.
- Until then, verify that aggregation endpoints require authentication and apply rate limiting.
- Monitor CPU and memory usage on web servers for abnormal growth.
- Check the vendor advisory for the exact affected build list before rollout.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Telerik KB: ClassFactory CVE-2026-106137 www.telerik.com
- VulDB entry 435884 vuldb.com
- CVE record mirror (threatint) cve.threatint.com
- OffSeq Radar: CVE-2026-106137 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:24.
Original description (NVD)
In affected versions of Progress® Telerik® UI for ASP.NET MVC `2012.2.710` through `2026.3.811`, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version `2026.3.1015`.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.