CVE-2026-14865

Published: Jul 22, 2026Modified: Aug 6, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: security@progress.com (Secondary)

Description

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.

Affected (1)

Products: Progress: Telerik Ui For Asp.net Ajax

Progress

1 product

Telerik Ui For Asp.net Ajax

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Progress Telerik Ui For Asp.net Ajax	From 2009.31314 to 2026.2.708

Related CWEs

CWE-776

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (1)

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rlb-xxe-injection-client-state-cve-2026-14865

Source: security@progress.com

Vendor AdvisoryMitigation

Timeline

No history available yet.