PT-2026-34265 · Progress · Telerik Ui For Asp.Net Ajax

Monetary Authority · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-6022

Mitre

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-6022

Affected Products

Telerik Ui For Asp.Net Ajax

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-6022 · Security Note
• https://telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-6022 · Vendor Advisory