What is the CVSS score of CVE-2026-6022?

CVE-2026-6022 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Telerik UI for AJAX are affected by CVE-2026-6022?

Progress Telerik UI for AJAX RadAsyncUpload (versions prior to 2026.1.421) contains an unauthenticated remote denial-of-service vulnerability allowing attackers to exhaust disk storage by bypassing…. A patch is available.

How to fix or mitigate CVE-2026-6022?

Within 24 hours: Inventory all applications using Progress Telerik UI for AJAX and document current RadAsyncUpload component versions. Within 7 days: Upgrade affected instances to Progress Telerik UI for AJAX version 2026.1.421 or later; coordinate with development and operations teams for testing in non-production environments first. Within 30 days: Complete production deployment validation and confirm all instances are patched; implement file upload monitoring to detect anomalous upload patterns.

Telerik UI for AJAX CVE-2026-6022

EUVD-2026-24631 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-04-22 ProgressSoftware

GHSA-vf2r-6g4x-jc4h

Denial Of Service Telerik Ui For Asp Net Ajax

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Patch released

Apr 22, 2026 - 21:23 nvd

Patch available

Apr 22, 2026 - 09:01 EUVD

Analysis Generated

Apr 22, 2026 - 08:24 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:00 euvd

EUVD-2026-24631

Analysis Generated

Apr 22, 2026 - 08:00 vuln.today

CVE Published

Apr 22, 2026 - 07:07 nvd

HIGH 7.5

DescriptionCVE.org

In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.

AnalysisAI

Uncontrolled resource consumption in Progress Telerik UI for AJAX RadAsyncUpload component allows remote unauthenticated attackers to exhaust disk space by uploading files exceeding configured size limits through chunked upload bypass. The vulnerability arises from missing cumulative size validation during chunk reassembly, enabling attackers to circumvent intended upload restrictions. No authentication required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), making this exploitable against any internet-facing application using affected versions. Patch available in version 2026.1.421. No CISA KEV listing or public exploit code identified at time of analysis, but low attack complexity and no authentication barrier indicate straightforward exploitation potential.

Technical ContextAI

The RadAsyncUpload component in Telerik UI for ASP.NET AJAX implements chunked file upload functionality to handle large files by splitting them into smaller segments. The vulnerability (CWE-400: Uncontrolled Resource Consumption) occurs during the chunk reassembly process where the component fails to enforce cumulative size checks across all uploaded chunks. While individual chunks may pass size validation, the aggregate reassembled file can exceed configured MaxFileSize limits. This architectural flaw in state management across chunk boundaries allows attackers to bypass application-level upload restrictions. The affected product (cpe:2.3:a:progress_software:telerik_ui_for_asp.net_ajax) is a commercial ASP.NET component library widely used in enterprise web applications for file upload workflows, making it attractive for resource exhaustion attacks targeting business-critical systems.

RemediationAI

Upgrade to Progress Telerik UI for AJAX version 2026.1.421 or later, which implements cumulative size validation during chunk reassembly to prevent bypass of configured upload limits. Follow upgrade procedures in Progress Software advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-6022. If immediate patching is not feasible, implement web application firewall (WAF) rules to monitor and rate-limit total upload volumes per session or source IP, though this may impact legitimate large file uploads and requires careful threshold tuning. Alternatively, configure web server or storage layer disk quotas to limit total upload directory size, preventing system-wide exhaustion but potentially blocking legitimate uploads when quota reached. Disable RadAsyncUpload component entirely if chunked upload functionality is not business-critical, though this breaks existing upload workflows. Monitor disk space utilization on application and storage servers as compensating detective control. All workarounds trade availability guarantees for protection and should be considered temporary until patching.