CVE-2026-6022: Telerik UI for AJAX DoS Vulnerability

CVE-2026-6022 Overview

CVE-2026-6022 is a high-severity uncontrolled resource consumption vulnerability affecting Progress® Telerik® UI for AJAX prior to version 2026.1.421. The vulnerability exists in the RadAsyncUpload component, which fails to enforce cumulative size limits during chunk reassembly operations. This flaw allows attackers to upload files that exceed the configured maximum size, potentially leading to disk space exhaustion and denial of service conditions.

Critical Impact

Attackers can exploit this vulnerability to exhaust server disk space by uploading files in chunks that bypass size restrictions, causing denial of service and potential system instability.

Affected Products

• Progress® Telerik® UI for AJAX versions prior to 2026.1.421
• Applications utilizing the RadAsyncUpload component with chunked file upload functionality
• ASP.NET web applications implementing Telerik UI controls for file uploads

Discovery Timeline

• April 22, 2026 - CVE-2026-6022 published to NVD
• April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-6022

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). The RadAsyncUpload component in Telerik UI for AJAX implements a chunked file upload mechanism that allows large files to be uploaded in smaller segments for improved performance and reliability. However, the component fails to track and enforce the cumulative size of uploaded chunks during the reassembly process.

When files are uploaded in chunks, each individual chunk may pass size validation checks, but the component does not maintain a running total of the aggregate file size. This allows an attacker to upload an arbitrarily large file by splitting it into many smaller chunks, each of which appears valid individually.

The impact of successful exploitation includes disk space exhaustion on the target server, potential denial of service affecting the web application and other services on the same system, and possible cascading failures in environments with limited storage capacity.

Root Cause

The root cause of this vulnerability lies in the missing cumulative size enforcement logic within the chunk reassembly process. While the RadAsyncUpload component validates individual chunk sizes against configured limits, it does not aggregate these sizes to verify the total file size remains within acceptable bounds. This architectural oversight in the upload handler allows the configured MaxFileSize parameter to be effectively bypassed through chunked uploads.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can target any exposed application using vulnerable versions of RadAsyncUpload by:

1. Initiating a chunked file upload request to the target endpoint
2. Sending multiple small chunks that individually pass size validation
3. Continuing to send chunks until the cumulative file size far exceeds configured limits
4. Repeating this process to rapidly consume available disk space

The attack can be automated and executed at scale to accelerate disk exhaustion. Since the vulnerability requires no authentication, any publicly accessible upload endpoint using the vulnerable component is at risk.

Detection Methods for CVE-2026-6022

Indicators of Compromise

• Abnormally large files appearing in upload directories that exceed configured MaxFileSize limits
• Rapid decrease in available disk space on web servers hosting Telerik-based applications
• High volume of chunked upload requests from single IP addresses or unusual sources
• Upload directory containing files significantly larger than application-defined maximums
• Server logs showing numerous successful chunk upload completions for single sessions

Detection Strategies

• Monitor upload directories for files exceeding expected size thresholds using file system auditing
• Implement network-level monitoring to detect high-frequency chunked upload patterns targeting RadAsyncUpload endpoints
• Deploy application-level logging to track cumulative chunk sizes per upload session
• Configure alerts for disk utilization thresholds on servers hosting vulnerable applications
• Review IIS or ASP.NET logs for patterns indicative of chunk upload abuse

Monitoring Recommendations

• Enable disk space monitoring with alerting thresholds appropriate for your environment
• Implement rate limiting on upload endpoints to slow potential exploitation attempts
• Configure centralized logging for all file upload activity across affected applications
• Monitor for unusual patterns in Telerik.Web.UI.WebResource.axd handler requests
• Establish baseline metrics for normal upload behavior to identify anomalous activity

How to Mitigate CVE-2026-6022

Immediate Actions Required

• Upgrade Progress® Telerik® UI for AJAX to version 2026.1.421 or later immediately
• Audit all applications using RadAsyncUpload to identify vulnerable deployments
• Implement disk space monitoring and alerting as a compensating control until patches are applied
• Consider temporarily disabling chunked upload functionality if not business-critical
• Review upload directories for evidence of exploitation and clean up oversized files

Patch Information

Progress has released version 2026.1.421 of Telerik UI for AJAX which addresses this vulnerability by implementing proper cumulative size tracking during chunk reassembly. Organizations should upgrade to this version or later as soon as possible. For detailed patch information and upgrade guidance, refer to the Telerik Security Advisory for CVE-2026-6022.

Workarounds

• Implement web application firewall (WAF) rules to limit the total number of chunks per upload session
• Configure reverse proxy or load balancer rules to restrict cumulative upload sizes
• Deploy server-side scripts to monitor and enforce total file sizes in upload directories
• Implement application-level middleware to track and limit cumulative upload sizes per session
• Consider IP-based rate limiting for upload endpoints as a temporary defensive measure

# Example: Monitoring upload directory for oversized files (adjust path and size threshold)
find /var/www/uploads -type f -size +100M -exec ls -lh {} \;

# Example: Setting up disk space alerts (Linux)
df -h /var/www/uploads | awk 'NR==2 {if ($5+0 > 80) print "WARNING: Disk usage at " $5}'