PT-2026-34265 · Progress · Telerik Ui For Ajax

Monetary Authority · Published 2026-04-22 · Updated 2026-05-05 · CVE-2026-6022

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.1.421

Description RadAsyncUpload contains an uncontrolled resource consumption issue. This occurs because of missing cumulative size enforcement during chunk reassembly, which allows file uploads to exceed the configured maximum size, potentially leading to disk space exhaustion.

Recommendations Update to version 2026.1.421.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-6022

Affected Products

Telerik Ui For Ajax

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-6022 · Security Note
• https://telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-6022 · Vendor Advisory
• https://t.me/cveNotify/162232 · Telegram Post
• https://twitter.com/CVEnew/status/2047428146740502807 · Twitter Post