CVE-2026-6022: Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress® Telerik® UI for AJAXto a version that resolves this vulnerability.Fixed in 2026.1.421 - Compensating control
Reduce exposure by restricting file upload access/permissions to only required users and paths until Telerik UI for AJAX is upgraded to 2026.1.421.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6022?
CVE-2026-6022 has been classified with a high severity level due to its potential for causing resource exhaustion through uncontrolled file uploads.
How do I fix CVE-2026-6022?
To resolve CVE-2026-6022, upgrade Telerik UI for ASP.NET AJAX to version 2026.1.421 or later to implement the necessary security measures.
What types of software are affected by CVE-2026-6022?
CVE-2026-6022 affects Progress Telerik UI for ASP.NET AJAX versions prior to 2026.1.421.
What is the nature of the vulnerability in CVE-2026-6022?
CVE-2026-6022 is an uncontrolled resource consumption vulnerability that allows excessive file uploads beyond configured limits.
What are the risks of not addressing CVE-2026-6022?
Failing to address CVE-2026-6022 can lead to application downtime or degraded performance due to resource exhaustion from large file uploads.