CVE-2026-118036 in Telerik Document Processing Libraries
Summary
by MITRE • 10/28/2026
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Progress Telerik Document Processing Libraries, specifically affecting versions prior to 2026.3.1027, represents a critical class of application-level denial-of-service issues rooted in uncontrolled recursion and inefficient algorithmic complexity within the RadPdfProcessing component and associated artificial intelligence features for document summarization and question answering. This flaw allows an unauthenticated attacker to trigger catastrophic resource exhaustion on the host system by submitting specially crafted input data. The core technical deficiency lies in the library's inability to properly validate or limit the depth of recursive operations when parsing complex PDF structures or processing text inputs designed to exploit logical loops within the summarization algorithms. When a maliciously constructed PDF document containing deeply nested objects, circular references, or excessively large repetitive patterns is processed, the underlying code enters an infinite loop or consumes memory exponentially until system resources are depleted. Similarly, input strings submitted for AI-driven summarization can be engineered to trigger recursive function calls that never terminate, leading to a complete hang of the host process.
From a technical perspective, this vulnerability aligns with CWE-674, which describes uncontrolled recursion, and CWE-400, concerning unconstrained resource consumption. The attack vector is particularly dangerous because it does not require authentication, meaning any user or automated script interacting with the service can exploit the flaw. In environments where these libraries are used for high-throughput document processing services, such as enterprise content management systems or cloud-based AI platforms, a single successful exploitation attempt can cause significant downtime. The operational impact extends beyond simple process termination; it can lead to cascading failures in microservices architectures if the affected service is part of a larger cluster where resource starvation affects neighboring nodes through shared infrastructure constraints like CPU throttling or memory swapping.
The inclusion of artificial intelligence features for document summarization and question answering introduces additional attack surfaces that were not present in traditional PDF parsing alone. These AI components often rely on complex text processing pipelines that may involve recursive tokenization, attention mechanisms with quadratic complexity relative to input length, or iterative refinement loops. An attacker can craft inputs that maximize the computational steps required by these algorithms without providing meaningful content, effectively creating a computationally expensive trap. This transforms what might be considered a performance optimization issue into a severe security vulnerability capable of causing service outages. The lack of proper bounds checking on recursion depth and input size allows this exploitation to occur reliably across different operating systems where the libraries are deployed.
Mitigation strategies must prioritize immediate patching as the primary defense mechanism. Organizations utilizing Progress Telerik Document Processing Libraries should upgrade to version 2026.3.1027 or later, which contains fixes for these specific algorithmic flaws and recursion limits. In cases where upgrading is not immediately feasible, defensive coding practices such as implementing strict input size limits, enforcing maximum recursion depth counters in custom wrappers around the library calls, and deploying web application firewalls with rules to detect anomalous resource usage patterns can provide partial protection. Additionally, running these services within containerized environments with strict CPU and memory quotas can limit the blast radius of an exploitation attempt, ensuring that a single malicious request does not compromise the entire host infrastructure. Continuous monitoring for unusual spikes in processing time or memory consumption related to PDF parsing and AI text analysis is also recommended to detect potential active exploits in real-time.