Telerik UI for ASP.NET Core: Uncontrolled resource consumption in aggregation
Summary
Telerik UI for ASP.NET Core versions 2015.1.318 through 2026.3.811 retain dynamic assemblies and load contexts when server-side aggregation requests are repeated, with or without grouping. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint without authentication, causing process memory to grow until resources are exhausted and the application becomes unavailable. Disabling grouping in the client-side interface does not prevent direct requests with these descriptors.
Affected
- Telerik UI for ASP.NET Core 2015.1.318 through 2026.3.811
- Only applications that expose the server-side aggregation endpoint without authentication are exposed to remote exploitation.
Fixed in
- Telerik UI for ASP.NET Core 2026.3.1015
Workaround
- No vendor workaround confirmed. Disabling grouping in the client interface does not mitigate the issue.
- Interim measures (not from the vendor): restrict the aggregation endpoint to authenticated users or remove internet exposure, add rate limiting on that endpoint, and monitor process memory.
Exploitation
- Not known to be exploited; no CISA KEV entry found at the time of research.
- No public proof of concept found; unconfirmed.
Our recommendation
- Inventory ASP.NET Core applications that use Telerik UI components, including MVC installations (see CVE-2026-106137).
- Upgrade to Telerik UI for ASP.NET Core 2026.3.1015 where the aggregation endpoint is reachable, prioritising internet-facing applications.
- Until patched, restrict the aggregation endpoint to authenticated users and apply rate limiting.
- Monitor application server memory usage for continuous growth.
- Check the vendor advisory directly, as the version range was taken from third-party sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Telerik security advisory CVE-2026-106156 www.telerik.com
- Telerik UI ASP.NET Core release history www.telerik.com
- VulDB entry 435885 vuldb.com
- Offseq threat radar CVE-2026-106156 radar.offseq.com
- ComponentSource Telerik UI ASP.NET Core releases www.componentsource.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:24.
Original description (NVD)
In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.