Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-106137

Race condition in Telerik UI for ASP.NET MVC aggregation

CVSS 3.1
8.6 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-106137 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

In Progress Telerik UI for ASP.NET MVC, ClassFactory updates a shared class dictionary without exclusive write protection and keeps non-collectible dynamic assemblies for the AppDomain lifetime. An unauthenticated remote attacker who can reach an aggregation endpoint can send concurrent or repeated crafted requests. That can corrupt dictionary state or raise CPU and memory use, degrading availability.

What to do: Upgrade Progress Telerik UI for ASP.NET MVC to 2026.3.1015.

ProductAffectedFixed in
Progress Telerik UI for ASP.NET MVC2012.2.710 through 2026.3.8112026.3.1015
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

In affected versions of Progress® Telerik® UI for ASP.NET MVC `2012.2.710` through `2026.3.811`, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version `2026.3.1015`.

Weakness
CWE-362, CWE-401
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story