CVE-2026-14865

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rlb-xxe-injection-client-state-cve-2026-14865	Vendor Advisory Mitigation

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) En Progress® Telerik® UI for AJAX anterior a la v2026.2.708, el control interno LayoutBuilder procesa XML de estado de cliente sin deshabilitar el procesamiento de DTD, lo que permite una denegación de servicio no autenticada mediante expansión recursiva de entidades XML.

Information

Published : 2026-07-22 14:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-14865

Mitre link : CVE-2026-14865

CVE.ORG link : CVE-2026-14865

JSON object : View

Products Affected

progress

telerik_ui_for_asp.net_ajax

CWE

CWE-776

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

{"id": "CVE-2026-14865", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14865", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T19:09:57.174189Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress Software", "product": "Telerik UI for ASP.NET AJAX", "versions": [{"status": "affected", "version": "2009.1.314", "lessThan": "2026.2.708", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-22T14:17:15.163", "references": [{"url": "https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rlb-xxe-injection-client-state-cve-2026-14865", "tags": ["Vendor Advisory", "Mitigation"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-776"}]}], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Telerik\u00ae UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion."}, {"lang": "es", "value": "En Progress\u00ae Telerik\u00ae UI for AJAX anterior a la v2026.2.708, el control interno LayoutBuilder procesa XML de estado de cliente sin deshabilitar el procesamiento de DTD, lo que permite una denegaci\u00f3n de servicio no autenticada mediante expansi\u00f3n recursiva de entidades XML."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E022FD99-4A6C-4D0A-938D-92C6B48260F7", "versionEndExcluding": "2026.2.708", "versionStartIncluding": "2009.31314"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}