XXE Denial of Service via RadLayoutBuilder Client State (CVE-2026-14865)

Updated on Jul 22, 2026

Description

July 2026 - CVE-2026-14865

• Progress® Telerik® UI for AJAX Q2 2026 v.2026.2.519 or earlier.

What Are the Impacts

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the LayoutBuilder control processes XML from its client state (_ClientState hidden field) without disabling DTD processing. An attacker can submit a forged postback containing recursive XML entity definitions (billion-laughs attack) that cause exponential memory consumption on the server, leading to denial of service.

On .NET Framework 4.6.2 and later (the minimum supported version by Telerik UI for ASP.NET AJAX), external entity resolution is disabled by framework defaults, limiting the impact to denial of service via internal entity expansion.

The LayoutBuilder control is an internal, undocumented component not intended for direct use — it is not exposed in the Toolbox, has no documentation, and is not instantiated by any Telerik control. If you are using it on a page, see the mitigation section below.

Is My Application Vulnerable?

Your application may be vulnerable if all of the following are true:

• The application uses a <telerik:LayoutBuilder> tag explicitly declared in page markup.
• The page is accessible without authentication or to low-privilege users.

Issue

• CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
• CAPEC-197: Exponential Data Expansion

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Current Version	Update to
>= 2009.1.314 && <= 2026.2.519 (2026 Q2)	>= 2026.2.708 (2026 Q2 SP1)

Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for AJAX can access their downloads here Product Downloads | Your Account.

Mitigation

If an immediate upgrade is not possible, remove LayoutBuilder from pages. The LayoutBuilder is an internal, undocumented control, thus if your application explicitly declares <telerik:LayoutBuilder> on any page, remove it. No Telerik feature depends on this server-side control being placed in page markup.

Notes

• Verify that your application's web.config has <httpRuntime targetFramework="4.6.2" /> or higher. Applications with a legacy targetFramework value below 4.5.2 may be exposed to additional risk beyond denial of service.
• If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
• We would like to thank the researchers at TantoSec for their responsible disclosure and cooperation.

External References

CVE-2026-14865 (Medium)

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3)

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive entity expansion.

Discoverer Credit: Marcio Almeida of TantoSec