# Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser (CVE-2026-106154)

## Description

October 2026 - [CVE-2026-106154](https://www.cve.org/CVERecord?id=CVE-2026-106154)

* Progress® Telerik® UI for ASP.NET Core `2026.3.1015` or earlier.

### What Are the Impacts

In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.

## Issue

* CWE-674: Uncontrolled Recursion
* CAPEC-230: Serialized Data Parameter Blowup

## Solution

The issue is fixed in version `2026.4.1111`. The Progress Telerik team strongly recommends upgrading to this version or later.

| Current Version                       | Update to         |
| ------------------------------------- | ----------------- |
| `>= v2015.1.318` && `<= v2026.3.1015` | `>= v2026.4.1111` |

Follow the [Telerik UI for ASP.NET Core update instructions](https://www.telerik.com/aspnet-core-ui/documentation/installation/upgrading) for precise instructions. All customers who have a license for Progress® Telerik® UI for ASP.NET Core can access their downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download).

## Notes

* This issue was identified internally by the Progress Telerik Security Team.
* If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to customers with an active support plan.

## External References

[CVE-2026-106154](https://www.cve.org/CVERecord?id=CVE-2026-106154) (High)

**CVSS:** 8.6

**Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H`

In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.