In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.
| Vendor | Product | Versions |
|---|---|---|
| progress | telerik ui for asp.net ajax | 2009.1.314 |
Severity upgraded from MEDIUM to CRITICAL, CVSS score raised to 9.0, added CWE-611 (XXE), extended affected versions to include 2026.2.707, and clarified vulnerability as XXE (not just DoS) with potential for information disclosure.
Initial creation
