CVE-2026-13182

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-padding-oracle-cve-2026-13182	Vendor Advisory Mitigation

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*

History

24 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) En Progress® Telerik® UI for AJAX anterior a la v2026.2.708, el procesamiento del estado del cliente de RadAsyncUpload puede distinguir los fallos de descifrado de los fallos de análisis de JSON no válido, creando un oráculo que revela valores de metadatos protegidos a atacantes remotos.

Information

Published : 2026-07-22 14:17

Updated : 2026-10-24 17:10

NVD link : CVE-2026-13182

Mitre link : CVE-2026-13182

CVE.ORG link : CVE-2026-13182

JSON object : View

Products Affected

progress

telerik_ui_for_asp.net_ajax

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2026-13182", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13182", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T19:14:37.602048Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress Software", "product": "Telerik UI for ASP.NET AJAX", "versions": [{"status": "affected", "version": "2010.1.309", "lessThan": "2026.2.708", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-22T14:17:13.683", "references": [{"url": "https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-padding-oracle-cve-2026-13182", "tags": ["Vendor Advisory", "Mitigation"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Telerik\u00ae UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers."}, {"lang": "es", "value": "En Progress\u00ae Telerik\u00ae UI for AJAX anterior a la v2026.2.708, el procesamiento del estado del cliente de RadAsyncUpload puede distinguir los fallos de descifrado de los fallos de an\u00e1lisis de JSON no v\u00e1lido, creando un or\u00e1culo que revela valores de metadatos protegidos a atacantes remotos."}], "lastModified": "2026-10-24T17:10:00.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59073663-4B3D-4E2A-BEF6-4E5B547F7219", "versionEndExcluding": "2026.2.708", "versionStartIncluding": "2010.1309"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}