CVE-2026-6022

Published: Apr 22, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security@progress.com (Secondary)

Description

In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.

Affected (1)

Products: Progress: Telerik Ui For Asp.net Ajax

1 product

Telerik Ui For Asp.net Ajax

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Progress Telerik Ui For Asp.net Ajax	Before 2026.1.421

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (1)

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-6022

Source: security@progress.com

MitigationVendor Advisory

Timeline

No history available yet.