[Solved] Breaking Regression issue in 2026.2.708.462 for RadAsyncUpload security vulnerability fix

[Shawn]

After receiving the email from Progress titled "Action Required: Security Vulnerabilities for Telerik UI for ASP.NET AJAX" regarding a security vulnerability in the RadAsyncUpload control, I updated my nuget packages to the latest version:  2025.3.812.462 --> 2026.2.708.462.  Everything else in the update is working successfully except for any page in which the RadAsyncUpload control lives.  

When the page loads, I receive the following error:

Type : System.NullReferenceException, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Message : Object reference not set to an instance of an object.
Source : Telerik.Web.UI
Help link : 
Data : System.Collections.ListDictionaryInternal
TargetSite : Void DescribeComponent(Telerik.Web.UI.IScriptDescriptor)
HResult : -2147467261
Stack Trace :    at Telerik.Web.UI.RadAsyncUpload.DescribeComponent(IScriptDescriptor descriptor)
   at Telerik.Web.UI.ScriptRegistrar.GetScriptDescriptors(Control control)
   at Telerik.Web.UI.RadWebControl.GetScriptDescriptors()
   at System.Web.UI.ScriptControlManager.RegisterScriptDescriptors(IScriptControl scriptControl)
   at Telerik.Web.UI.RadWebControl.RegisterScriptDescriptors()
   at Telerik.Web.UI.RadWebControl.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.HtmlControls.HtmlContainerControl.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.HtmlControls.HtmlTableRow.RenderChildren(HtmlTextWriter writer)
   at System.Web.UI.HtmlControls.HtmlContainerControl.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.HtmlControls.HtmlTable.RenderChildren(HtmlTextWriter writer)
   at System.Web.UI.HtmlControls.HtmlContainerControl.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.HtmlControls.HtmlForm.RenderChildren(HtmlTextWriter writer)
   at System.Web.UI.HtmlControls.HtmlContainerControl.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.HtmlControls.HtmlForm.RenderControl(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.Page.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at Telerik.Web.UI.RadAjaxControl.RenderPageInAjaxMode(HtmlTextWriter writer, Control page)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.Page.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Another application updated to the latest version using the RadAsyncUpload works perfectly fine.  After researching, I discovered that my "broken" application is session-less, and my other application (which updated successfully) had no issues whatsoever.  In the previous version, 2025.3.812.462, RadAsyncUpload worked perfectly with a session-less application.  I've since had to implement session in order to resolve both the page load issue and the security vulnerability for the RadAsyncUpload.

 

[JP]

We also just updated and ran into the same issue. We also have session state disabled. This needs to be prioritized.

[Attila Antal]

Hello Shawn,

Thank you for reporting the issue. This is a regression we introduced earlier this year. We have received a report earlier about the same and we were able to fix it promptly, see Disabling session state and csrf causes null reference exception when using async upload.

Due to the nature of the issue, I'm afraid I can't offer a workaround that allows using the AsyncUpload control without having the Session state enabled. I can recommend enabling the Session until the next release. If you choose to downgrade, please be sure to apply the Security mitigations as earlier versions have some known vulnerabilities. Should you choose this path, let us know and we'll assist you further.

Please excuse us for any inconvenience this may have caused.

Regards,
Attila Antal
Progress Telerik