CVE-2026-106156

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106156", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-10-06T15:51:11.738Z", "datePublished": "2026-11-11T17:24:56.315Z", "dateUpdated": "2026-11-11T17:24:56.315Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-11-11T17:24:56.315Z"}, "title": "Uncontrolled Resource Consumption in Telerik UI for ASP.NET Core Server-side Aggregation", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Excessive Allocation"}]}], "affected": [{"vendor": "Progress Software", "product": "Telerik UI for ASP.NET Core", "versions": [{"status": "affected", "version": "2015.1.318", "lessThan": "2026.3.1015", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Telerik\u00ae UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Progress\u00ae Telerik\u00ae UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`.</p>"}]}], "references": [{"url": "https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-106156", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"}}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Telerik UI for ASP.NET Core", "vendor": "Progress Software", "versions": [{"lessThan": "2026.3.1015", "status": "affected", "version": "2015.1.318", "versionType": "custom"}]}], "source": "security@progress.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Telerik\u00ae UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`."}], "id": "CVE-2026-106156", "lastModified": "2026-11-12T19:02:35.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "security@progress.com", "type": "Secondary"}]}, "published": "2026-11-11T18:18:24.423", "references": [{"source": "security@progress.com", "url": "https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-106156"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security@progress.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2015.1.318,2026.3.1015)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Telerik UI for ASP.NET Core", "source": "cna", "vendor": "Progress Software"}, "product": "telerik_ui_for_asp.net_core", "vendor": "progress"}], "created": "2026-11-12T07:15:21.796229+00:00", "updated": "2026-11-13T02:00:10.150165+00:00", "vendors": ["progress", "progress$PRODUCT$telerik_ui_for_asp.net_core"]}