Is CVE-2026-14865 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14865 being exploited in the wild.

How severe is CVE-2026-14865?

Medium severity, with a CVSS score of 5.3, published 22 July 2026.

Which products and versions are affected?

Progress Software Telerik UI for ASP.NET AJAX 2009.1.314 through 2026.2.519.

Is there a fix for CVE-2026-14865?

A patch was published on 2026-07-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14865 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14865?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14865: Progress Telerik UI for AJAX denial of service in LayoutBuilder

CVE-2026-14865 · Severity: medium · CVSS 5.3 · Published 2026-07-22

A vulnerability exists in a specific internal component of Telerik UI for ASP.NET AJAX, a popular suite of UI controls for web applications. An attacker can send a specially crafted request to a web page using the affected component to exhaust server memory, causing the website to become unresponsive or crash. This issue primarily affects applications that have manually implemented the undocumented LayoutBuilder control.

Quick answers

Is CVE-2026-14865 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14865 being exploited in the wild.
How severe is CVE-2026-14865?: Medium severity, with a CVSS score of 5.3, published 22 July 2026.
Which products and versions are affected?: Progress Software Telerik UI for ASP.NET AJAX 2009.1.314 through 2026.2.519.
Is there a fix for CVE-2026-14865?: A patch was published on 2026-07-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14865 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14865?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a CWE-776 (XML Entity Expansion) issue within the internal, undocumented LayoutBuilder control. The control processes XML from the '_ClientState' hidden field without disabling Document Type Definition (DTD) processing. An unauthenticated attacker can submit a forged postback containing recursive XML entity definitions (a 'billion laughs' attack), leading to exponential memory consumption and a Denial of Service (DoS). While the impact is limited to DoS on .NET Framework 4.6.2+ due to default external entity restrictions, older frameworks may face additional risks. The issue is resolved in version 2026.2.708.

Affected products

Progress Software Telerik UI for ASP.NET AJAX 2009.1.314 through 2026.2.519

Timeline

2026-07-22: advisory
2026-07-22: patched

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rlb-xxe-injection-client-state-cve-2026-14865

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.