CVE-2026-106137: ClassFactory Race Condition and Retained Assembly Memory in Telerik UI for ASP.NET MVC
In affected versions of Progress® Telerik® UI for ASP.NET MVC 2012.2.710 through 2026.3.811, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version 2026.3.1015.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Telerik UI for ASP.NET MVCto a version that resolves this vulnerability.Fixed in 2026.3.1015
Event History
Frequently Asked Questions
Which applications are realistically exposed to unauthenticated exploitation?
Applications using affected Telerik UI for ASP.NET MVC versions are exposed if they provide an aggregation endpoint that is reachable without authentication. The attacker must be able to send concurrent or repeated crafted requests to that endpoint.
Are default deployments necessarily affected?
The provided information does not establish whether aggregation endpoints are exposed without authentication by default. Exposure depends on whether the application makes such an endpoint reachable to unauthenticated users.
What can be done if upgrading is not immediately possible?
Restrict unauthenticated access to aggregation endpoints so that remote unauthenticated attackers cannot submit the crafted concurrent or repeated requests needed to exploit the issue.
How can I determine whether my application is affected?
Check whether the application uses Telerik UI for ASP.NET MVC versions 2012.2.710 through 2026.3.811 and whether it exposes an aggregation endpoint without authentication. Systems running version 2026.3.1015 are fixed.