CVE-2026-106154
Received Received - Intake

Telerik UI for ASP.NET Core Stack Overflow in FilterParser

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: Progress Software Corporation

Description
In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-106154
EUVD
EUVD-2026-124560

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software Telerik UI for ASP.NET Core From 2015.1.318 (inc) to 2026.3.1015 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Progress Telerik UI for ASP.NET Core versions 2015.1.318 through 2026.3.1015. The server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit. The FilterLexer also does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication.

Detection Guidance

To detect this vulnerability, monitor for excessive CPU usage or stack overflow errors in applications using Telerik UI for ASP.NET Core versions 2015.1.318 through 2026.3.1015. Check logs for StackOverflowException errors during model binding with DataSourceRequest endpoints.

Impact Analysis

An attacker could send deeply nested filters to trigger parsing errors during model binding or cause a StackOverflowException, leading to denial of service. This could crash the application or server if the endpoint is exposed without authentication.

Mitigation Strategies

Immediately upgrade to Telerik UI for ASP.NET Core version 2026.4.1111 or later. If upgrading is not possible, restrict access to endpoints using DataSourceRequest model binding to authenticated users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106154. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...