After receiving the email from Progress titled "Action Required: Security Vulnerabilities for Telerik UI for ASP.NET AJAX" regarding a security vulnerability in the RadAsyncUpload control, I updated my nuget packages to the latest version: 2025.3.812.462 --> 2026.2.708.462. Everything else in the update is working successfully except for any page in which the RadAsyncUpload control lives.
When the page loads, I receive the following error:
Type : System.NullReferenceException, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 Message : Object reference not set to an instance of an object. Source : Telerik.Web.UI Help link : Data : System.Collections.ListDictionaryInternal TargetSite : Void DescribeComponent(Telerik.Web.UI.IScriptDescriptor) HResult : -2147467261 Stack Trace : at Telerik.Web.UI.RadAsyncUpload.DescribeComponent(IScriptDescriptor descriptor) at Telerik.Web.UI.ScriptRegistrar.GetScriptDescriptors(Control control) at Telerik.Web.UI.RadWebControl.GetScriptDescriptors() at System.Web.UI.ScriptControlManager.RegisterScriptDescriptors(IScriptControl scriptControl) at Telerik.Web.UI.RadWebControl.RegisterScriptDescriptors() at Telerik.Web.UI.RadWebControl.Render(HtmlTextWriter writer) at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) at System.Web.UI.HtmlControls.HtmlContainerControl.Render(HtmlTextWriter writer) at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) at System.Web.UI.HtmlControls.HtmlTableRow.RenderChildren(HtmlTextWriter writer) at System.Web.UI.HtmlControls.HtmlContainerControl.Render(HtmlTextWriter writer) at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) at System.Web.UI.HtmlControls.HtmlTable.RenderChildren(HtmlTextWriter writer) at System.Web.UI.HtmlControls.HtmlContainerControl.Render(HtmlTextWriter writer) at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) at System.Web.UI.HtmlControls.HtmlForm.RenderChildren(HtmlTextWriter writer) at System.Web.UI.HtmlControls.HtmlContainerControl.Render(HtmlTextWriter writer) at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) at System.Web.UI.HtmlControls.HtmlForm.RenderControl(HtmlTextWriter writer) at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) at System.Web.UI.Page.Render(HtmlTextWriter writer) at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) at Telerik.Web.UI.RadAjaxControl.RenderPageInAjaxMode(HtmlTextWriter writer, Control page) at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) at System.Web.UI.Page.Render(HtmlTextWriter writer) at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
Another application updated to the latest version using the RadAsyncUpload works perfectly fine. After researching, I discovered that my "broken" application is session-less, and my other application (which updated successfully) had no issues whatsoever. In the previous version, 2025.3.812.462, RadAsyncUpload worked perfectly with a session-less application. I've since had to implement session in order to resolve both the page load issue and the security vulnerability for the RadAsyncUpload.