CVE-2026-6022: Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-22 · updated 2026-10-26
Weakness: CWE-400

Description

In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.

Affected products

Progress Software Telerik UI for ASP.NET AJAX: before 2026.1.421 — fixed in 2026.1.421

How to fix

Upgrade to a fixed version: Progress Software Telerik UI for ASP.NET AJAX 2026.1.421. Check the vendor advisory for mitigations.

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-6022

Get alerted when CVE-2026-6022 or the next vulnerability affects your stack