Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser (CVE-2026-106154)
Description
October 2026 - CVE-2026-106154
- Progress® Telerik® UI for ASP.NET Core
2026.3.1015or earlier.
What Are the Impacts
In Progress® Telerik® UI for ASP.NET Core versions 2015.1.318 through 2026.3.1015, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause StackOverflowException. This issue is fixed in version 2026.4.1111.
Issue
- CWE-674: Uncontrolled Recursion
- CAPEC-230: Serialized Data Parameter Blowup
Solution
The issue is fixed in version 2026.4.1111. The Progress Telerik team strongly recommends upgrading to this version or later.
| Current Version | Update to |
|---|---|
>= v2015.1.318 && <= v2026.3.1015 | >= v2026.4.1111 |
Follow the Telerik UI for ASP.NET Core update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for ASP.NET Core can access their downloads here Product Downloads | Your Account.
Notes
- This issue was identified internally by the Progress Telerik Security Team.
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-106154 (High)
CVSS: 8.6
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
In Progress® Telerik® UI for ASP.NET Core versions 2015.1.318 through 2026.3.1015, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause StackOverflowException. This issue is fixed in version 2026.4.1111.