EUVD-2026-47698
GHSA-8qxm-qvqw-xx9r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable, unauthenticated XML POST with no user interaction; impact limited to availability via resource exhaustion, no confidentiality or integrity effect.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
Lifecycle Timeline
2DescriptionCVE.org
In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.
AnalysisAI
Unauthenticated denial-of-service in Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) is possible because the internal LayoutBuilder control parses client-submitted XML without disabling DTD processing, exposing recursive XML entity expansion (CWE-776, 'Billion Laughs'). Any network-reachable attacker can send a crafted HTTP request containing a self-referencing DTD payload to cause exponential memory and CPU exhaustion on the server-side process. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low attack complexity and absence of authentication make this a straightforward DoS primitive once the target endpoint is located.
Technical ContextAI
The vulnerability resides in the LayoutBuilder control within Progress Software's Telerik UI for ASP.NET AJAX component library (CPE: cpe:2.3:a:progress_software:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*), a commercial suite of WebForms UI widgets used in .NET Framework-based web applications. The control deserializes client-state data encoded as XML, and the underlying XML parser is instantiated without setting ProhibitDtd=true (or the equivalent XmlReaderSettings.DtdProcessing = DtdProcessing.Prohibit in modern .NET). CWE-776 ('Improper Restriction of Recursive Entity References in DTDs') describes the root cause: when DTD processing is permitted, an attacker can declare an entity that references itself recursively or references chained intermediate entities, causing the parser to expand the payload into exponential memory consumption before any application logic can validate or bound the input. This is the classic 'Billion Laughs' class of XML DoS, well-understood since at least 2003 and trivially achievable with a small crafted payload.
RemediationAI
The primary fix is to upgrade to Progress Telerik UI for ASP.NET AJAX version 2026.2.708 or later, which addresses DTD processing in the LayoutBuilder control. Details and download instructions are available in the vendor advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rlb-xxe-injection-client-state-cve-2026-14865. If immediate upgrade is not possible, a compensating control is to deploy a web application firewall (WAF) rule that inspects and blocks HTTP request bodies or form fields containing DTD declarations (specifically patterns like '<!DOCTYPE' or '<!ENTITY') targeting ASP.NET AJAX postback endpoints. This blocks the payload delivery but introduces a risk of false positives if any legitimate application workflow submits XML with DOCTYPE declarations. A second compensating control is to restrict network access to LayoutBuilder-enabled pages to authenticated, internal users only via network ACLs or IIS IP-restriction rules, which raises the effective attack bar from PR:N to requiring prior access; however, this is only viable if the affected pages are not intended to be publicly accessible.
More in Telerik Ui For Asp Net Ajax
View allAn issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. Rated critical severity (CVSS 9.8), this vul
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX be
Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with exte
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistenc
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resoluti
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metada
Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the
Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allo
Remote code execution in Progress Telerik UI for ASP.NET AJAX (prior to v2026.3.812) is achievable by an attacker who ha
In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attacker
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today