CVE-2026-14865: Telerik UI for AJAX DoS Vulnerability

CVE-2026-14865 Overview

CVE-2026-14865 is an XML External Entity (XXE) vulnerability in Progress® Telerik® UI for AJAX versions prior to v2026.2.708. The internal LayoutBuilder control processes client-state XML without disabling Document Type Definition (DTD) processing. An unauthenticated remote attacker can submit crafted XML containing recursive entity expansions to trigger a denial of service. The flaw is tracked under [CWE-776] (Improper Restriction of Recursive Entity References in DTDs, also known as XML Entity Expansion or Billion Laughs).

Critical Impact
Unauthenticated attackers can exhaust server resources by sending crafted XML payloads to any application exposing the vulnerable LayoutBuilder control, causing service disruption.

Affected Products

Progress Telerik UI for AJAX prior to v2026.2.708
ASP.NET AJAX web applications embedding the internal LayoutBuilder control
Any hosted web application bundling vulnerable Telerik AJAX assemblies

Discovery Timeline

2026-07-22 - CVE-2026-14865 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-14865

Vulnerability Analysis

The vulnerability resides in the internal LayoutBuilder control shipped with Progress Telerik UI for AJAX. The control accepts serialized client-state data in XML form and passes it to an XML parser that leaves DTD processing enabled. Because inline DTDs are honored, an attacker can define nested entities that reference one another exponentially. When the parser expands these entities, memory and CPU consumption grow rapidly.

This is the classic XML Entity Expansion pattern, often called a Billion Laughs attack. The parser does not require external network resolution, so egress restrictions do not mitigate the attack. Exploitation succeeds without authentication and requires no user interaction.

Although confidentiality and integrity are not directly affected, sustained requests can render the hosting IIS worker process or ASP.NET application unresponsive. The vulnerability is network-reachable through any endpoint that surfaces the LayoutBuilder control or accepts its client state.

Root Cause

The root cause is missing hardening of the XML reader used by LayoutBuilder. The parser is instantiated without setting DtdProcessing = DtdProcessing.Prohibit and without capping entity expansion limits. This permits recursive entity references to be resolved during deserialization of client-state XML.

Attack Vector

An unauthenticated remote attacker submits an HTTP POST request to a page containing the LayoutBuilder control. The request body carries an XML document with a malicious inline DTD that defines chained entities such as &lol9; expanding through &lol1;. When the server parses the payload, entity expansion consumes memory and CPU until the worker process becomes unresponsive. See the Telerik Security Advisory CVE-2026-14865 for vendor technical details. No verified public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-14865

Indicators of Compromise

HTTP requests to .aspx endpoints containing XML bodies with inline <!DOCTYPE> declarations and nested <!ENTITY> definitions
Sudden spikes in IIS worker process (w3wp.exe) memory or CPU utilization correlated with inbound requests to Telerik AJAX pages
Repeated client-state POST bodies referencing entity names such as lol, bomb, or long chains of self-referential entities

Detection Strategies

Inspect web application firewall (WAF) logs for XML payloads containing DTD declarations submitted to Telerik AJAX handlers
Alert on ASP.NET application pool recycles or unresponsive states coinciding with unusual request volumes
Baseline request body size and parse duration for Telerik endpoints and flag statistical outliers

Monitoring Recommendations

Enable IIS request tracing on pages hosting the LayoutBuilder control and forward logs to a centralized analytics platform
Monitor .NET CLR Memory performance counters on affected servers for abnormal Gen 2 heap growth
Correlate WAF, IIS, and application logs to identify repeat sources submitting malformed XML client state

How to Mitigate CVE-2026-14865

Immediate Actions Required

Upgrade Progress Telerik UI for AJAX to v2026.2.708 or later on all application servers
Inventory ASP.NET applications for bundled Telerik.Web.UI assemblies and confirm versions from the file properties
Deploy WAF rules that reject inbound XML payloads containing <!DOCTYPE or <!ENTITY declarations directed at Telerik handlers

Patch Information

Progress has released a fix in Telerik UI for AJAX v2026.2.708. The update disables DTD processing in the XML reader used by the LayoutBuilder control. Refer to the Telerik Security Advisory CVE-2026-14865 for full remediation guidance and download links.

Workarounds

Block or filter HTTP requests carrying inline DTD declarations at an upstream WAF or reverse proxy until patching is complete
Restrict access to pages hosting the LayoutBuilder control to authenticated users or trusted network segments
Apply IIS request filtering to cap maximum allowed content length for endpoints that receive client-state XML

bash

# Configuration example: IIS request filtering to cap payload size
# Applied via web.config on affected application
# <system.webServer>
#   <security>
#     <requestFiltering>
#       <requestLimits maxAllowedContentLength="65536" />
#     </requestFiltering>
#   </security>
# </system.webServer>