CVE-2026-6022

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6022", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-04-09T15:47:25.214Z", "datePublished": "2026-04-22T07:07:30.795Z", "dateUpdated": "2026-04-22T12:28:18.218Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-04-22T07:07:30.795Z"}, "title": "Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-572", "descriptions": [{"lang": "en", "value": "CAPEC-572 Artificially Inflate File Sizes"}]}], "affected": [{"vendor": "Progress Software", "product": "Telerik UI for ASP.NET AJAX", "versions": [{"status": "affected", "version": "2011.2.712", "lessThan": "2026.1.421", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Telerik\u00ae UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Progress\u00ae Telerik\u00ae UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.</p>"}]}], "references": [{"url": "https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-6022", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "credits": [{"lang": "en", "value": "Monetary Authority of Singapore", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T12:25:41.076779Z", "id": "CVE-2026-6022", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T12:28:18.218Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6022", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T12:25:41.076779Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T12:28:13.338Z"}}], "cna": {"title": "Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Monetary Authority of Singapore"}], "impacts": [{"capecId": "CAPEC-572", "descriptions": [{"lang": "en", "value": "CAPEC-572 Artificially Inflate File Sizes"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software", "product": "Telerik UI for ASP.NET AJAX", "versions": [{"status": "affected", "version": "2011.2.712", "lessThan": "2026.1.421", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-6022", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In Progress\u00ae Telerik\u00ae UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.", "supportingMedia": [{"type": "text/html", "value": "<p>In Progress\u00ae Telerik\u00ae UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-04-22T07:07:30.795Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6022", "state": "PUBLISHED", "dateUpdated": "2026-04-22T12:28:18.218Z", "dateReserved": "2026-04-09T15:47:25.214Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2026-04-22T07:07:30.795Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Telerik UI for ASP.NET AJAX", "vendor": "Progress Software", "versions": [{"lessThan": "2026.1.421", "status": "affected", "version": "2011.2.712", "versionType": "custom"}]}], "source": "security@progress.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2294D8C-7233-41C4-8A32-DB1239FC7805", "versionEndExcluding": "2026.1.421", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Telerik\u00ae UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion."}, {"lang": "es", "value": "En Progress\u00ae Telerik\u00ae UI for AJAX anterior a 2026.1.421, RadAsyncUpload contiene una vulnerabilidad de consumo de recursos no controlado que permite que las cargas de archivos excedan el tama\u00f1o m\u00e1ximo configurado debido a la falta de aplicaci\u00f3n del tama\u00f1o acumulativo durante el reensamblaje de fragmentos, lo que lleva al agotamiento del espacio en disco."}], "id": "CVE-2026-6022", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@progress.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6022", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T12:25:41.076779Z", "version": "2.0.3"}}]}, "published": "2026-04-22T08:16:12.903", "references": [{"source": "security@progress.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-6022"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security@progress.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2011.2.712,2026.1.421)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "Telerik UI for ASP.NET AJAX", "source": "cna", "vendor": "Progress Software"}, "product": "telerik_ui_for_asp.net_ajax", "vendor": "progress"}], "analysis": {"en": {"generated_at": "2026-04-22T08:51:08.136905+00:00", "value": {"mitigation_remediation": ["Upgrade to Telerik UI for ASP.NET AJAX 2026.1.421 or later", "If a patch is not immediately available, remove or disable the RadAsyncUpload control to prevent file uploads", "Configure the web server (e.g., IIS request filtering) to reject uploads exceeding the maximum allowed size before reaching the application"], "summary": {"action": "Patch", "impact": "Uncontrolled Disk Space Exhaustion Leads to Denial of Service"}, "threat_synthesis": {"affected_systems": "Progress Software\u2019s Telerik UI for ASP.NET AJAX, versions earlier than 2026.1.421, are affected. Users running the RadAsyncUpload control in these releases should verify their installed version against this requirement.", "description_and_impact": "The vulnerability resides in the RadAsyncUpload component of Telerik UI for ASP.NET AJAX before version 2026.1.421. It allows users to upload files whose cumulative size is not properly checked during chunk reassembly, permitting uploads that exceed the configured maximum. This flaw can exhaust the hosting environment\u2019s disk space, potentially rendering the web application and related services unavailable.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity. Although an EPSS score is not provided, the lack of a known exploit in the KEV catalog suggests moderate exploitation likelihood. The attack is likely feasible over the public network via file upload functionality, as the flaw is triggered by submitting oversized uploads to the RadAsyncUpload endpoint."}}}}, "created": "2026-04-22T09:00:09.438506+00:00", "updated": "2026-04-22T11:30:15.176278+00:00", "vendors": ["progress", "progress$PRODUCT$telerik_ui_for_asp.net_ajax"]}