{"api_version":"1","generated_at":"2026-11-14T07:03:31+00:00","cve":"CVE-2026-106154","urls":{"html":"https://cve.report/CVE-2026-106154","api":"https://cve.report/api/cve/CVE-2026-106154.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-106154","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-106154"},"summary":{"title":"Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser","description":"In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.","state":"PUBLISHED","assigner":"ProgressSoftware","published_at":"2026-11-12 18:17:12","updated_at":"2026-11-12 19:02:35"},"problem_types":["CWE-674","CWE-674 CWE-674 Uncontrolled Recursion"],"metrics":[{"version":"3.1","source":"security@progress.com","type":"Secondary","score":"8.6","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.6","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-recursion-cve-2026-106154","name":"https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-recursion-cve-2026-106154","refsource":"security@progress.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106154","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106154","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Progress Software","product":"Telerik UI for ASP.NET Core","version":"affected 2015.1.318 2026.3.1015 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","product":"Telerik UI for ASP.NET Core","vendor":"Progress Software","versions":[{"lessThanOrEqual":"2026.3.1015","status":"affected","version":"2015.1.318","versionType":"custom"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.</p>"}],"value":"In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`."}],"impacts":[{"capecId":"CAPEC-230","descriptions":[{"lang":"en","value":"Serialized Data Parameter Blowup"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-674","description":"CWE-674 Uncontrolled Recursion","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T17:13:26.499Z","orgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","shortName":"ProgressSoftware"},"references":[{"tags":["vendor-advisory"],"url":"https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-recursion-cve-2026-106154"}],"source":{"discovery":"INTERNAL"},"title":"Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","assignerShortName":"ProgressSoftware","cveId":"CVE-2026-106154","datePublished":"2026-11-12T17:13:26.499Z","dateReserved":"2026-10-06T15:51:11.738Z","dateUpdated":"2026-11-12T17:13:26.499Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-12 18:17:12","lastModifiedDate":"2026-11-12 19:02:35","problem_types":["CWE-674","CWE-674 CWE-674 Uncontrolled Recursion"],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"106154","Ordinal":"1","Title":"Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterPars","CVE":"CVE-2026-106154","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"106154","Ordinal":"1","NoteData":"In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.","Type":"Description","Title":"Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterPars"}]}}}