CVE-2026-6022: In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to…

PriorityP342high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.29%

20.5th percentile

In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
progress	telerik_ui_for_asp.net_ajax	< 2026.1.421	2026.1.421
progress_software	telerik_ui_for_asp.net_ajax	>= 2011.2.712 < 2026.1.421	2026.1.421

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.