In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.
References
| Link | Resource |
|---|---|
| https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rlb-xxe-injection-client-state-cve-2026-14865 | Vendor Advisory Mitigation |
Configurations
History
06 Aug 2026, 17:45
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Progress
Progress telerik Ui For Asp.net Ajax |
|
| CPE | cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:* | |
| References | () https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rlb-xxe-injection-client-state-cve-2026-14865 - Vendor Advisory, Mitigation |
22 Jul 2026, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-22 14:17
Updated : 2026-08-06 17:45
NVD link : CVE-2026-14865
Mitre link : CVE-2026-14865
CVE.ORG link : CVE-2026-14865
JSON object : View
Products Affected
progress
- telerik_ui_for_asp.net_ajax
CWE
CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')