Executive brief
A vulnerability exists in a specific internal component of Telerik UI for ASP.NET AJAX, a popular suite of UI controls for web applications. An attacker can send a specially crafted request to a web page using the affected component to exhaust server memory, causing the website to become unresponsive or crash. This issue primarily affects applications that have manually implemented the undocumented LayoutBuilder control.
Technical details
The vulnerability is a CWE-776 (XML Entity Expansion) issue within the internal, undocumented LayoutBuilder control. The control processes XML from the '_ClientState' hidden field without disabling Document Type Definition (DTD) processing. An unauthenticated attacker can submit a forged postback containing recursive XML entity definitions (a 'billion laughs' attack), leading to exponential memory consumption and a Denial of Service (DoS). While the impact is limited to DoS on .NET Framework 4.6.2+ due to default external entity restrictions, older frameworks may face additional risks. The issue is resolved in version 2026.2.708.
Affected products
- Progress Software Telerik UI for ASP.NET AJAX 2009.1.314 through 2026.2.519
Timeline
- 2026-07-22: advisory
- 2026-07-22: patched