ClassFactory Race Condition and Retained Assembly Memory in Telerik UI for ASP.NET MVC (CVE-2026-106137)
Description
October 2026 - CVE-2026-106137
- Progress® Telerik® UI for ASP.NET MVC
2026.3.1015or earlier.
What Are the Impacts
In affected versions of Progress® Telerik® UI for ASP.NET MVC 2012.2.710 through 2026.3.1015, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version 2026.4.1111.
Issue
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- CWE-401: Missing Release of Memory after Effective Lifetime
- CAPEC-26: Leveraging Race Conditions
- CAPEC-130: Excessive Allocation
Solution
The issue is fixed in version 2026.4.1111. The Progress Telerik team strongly recommends upgrading to this version or later.
| Current Version | Update to |
|---|---|
>= v2012.2.710 && <= v2026.3.1015 | >= v2026.4.1111 |
Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for ASP.NET MVC can access their downloads here Product Downloads | Your Account.
Notes
- This issue was identified internally by the Progress Telerik Security Team.
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-106137 (High)
CVSS: 8.6
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
In affected versions of Progress® Telerik® UI for ASP.NET MVC 2012.2.710 through 2026.3.1015, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version 2026.4.1111.