CVE-2026-106154: Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser
In Progress® Telerik® UI for ASP.NET Core versions 2015.1.318 through 2026.3.1015, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause StackOverflowException. This issue is fixed in version 2026.4.1111.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Telerik UI for ASP.NET Coreto a version that resolves this vulnerability.Fixed in 2026.4.1111
Event History
Frequently Asked Questions
Which applications are exposed to exploitation?
Applications using affected Telerik UI for ASP.NET Core versions are exposed when they have an endpoint that uses DataSourceRequest model binding and that endpoint is reachable without authentication. Endpoints requiring authentication are not described as exploitable through the stated attack path.
What does an attacker need to send?
An unauthenticated remote attacker needs to submit untrusted filter parameters containing deeply nested expressions to a reachable DataSourceRequest-bound endpoint. No user interaction or prior privileges are required.
What is the operational impact of a successful attack?
Deeply nested filters can cause parsing errors during model binding or trigger a StackOverflowException. The stated impact is denial of service; confidentiality and integrity impacts are not indicated.
What should be done if an immediate upgrade is not possible?
Restrict unauthenticated access to endpoints that use DataSourceRequest model binding, since reachable unauthenticated endpoints are required for the described exploit path. Review exposed endpoints for acceptance of untrusted filter parameters.
How can teams determine whether they are affected?
Check whether the application uses Telerik UI for ASP.NET Core versions 2015.1.318 through 2026.3.1015 and exposes unauthenticated endpoints using DataSourceRequest model binding. Version 2026.4.1111 contains the fix.