CVE-2026-14865 in UI for ASP.NET AJAX
Summary
by MITRE • 07/22/2026
In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability exists within In Progress Telerik UI for AJAX framework version prior to v2026.2.708 where the internal LayoutBuilder control fails to properly configure XML parsing settings during client-state processing. This flaw stems from the control's handling of XML data structures that contain Document Type Definitions, which enables attackers to craft malicious payloads exploiting recursive entity expansion mechanisms. The absence of DTD processing disablement creates an inherent weakness in the XML parser configuration that directly exposes the application to denial of service attacks. When the LayoutBuilder processes client-state information containing crafted XML with recursive entities, the parser becomes vulnerable to exponential entity expansion, consuming system resources and ultimately leading to service disruption.
This vulnerability aligns with CWE-611, which specifically addresses improper restriction of XML external entity expansion, and represents a classic example of XML External Entity (XXE) processing flaws. The attack vector operates through unauthenticated remote exploitation, making it particularly dangerous as any user with access to the affected application can trigger the denial of service condition. The recursive nature of the XML entity expansion means that a small payload can cause significant resource consumption, potentially leading to complete system exhaustion or application unresponsiveness. This behavior directly maps to techniques described in the ATT&CK framework under T1499.004 for network denial of service and T1595.001 for reconnaissance through information discovery.
The operational impact extends beyond simple service interruption as the vulnerability affects the core functionality of the LayoutBuilder control, which is fundamental to application layout management within the Telerik UI framework. Attackers can leverage this weakness to repeatedly consume system resources, potentially causing cascading failures throughout the application stack, especially in environments where multiple concurrent users interact with the affected components. The vulnerability particularly impacts web applications using Telerik controls for dynamic content rendering and user interface management, creating a significant risk for enterprise applications that rely on these frameworks for business-critical operations.
Mitigation strategies should focus on immediate implementation of XML parser hardening measures including explicit disabling of DTD processing and external entity resolution within the affected control's XML parsing configuration. Organizations should upgrade to version v2026.2.708 or later where the vulnerability has been addressed through proper XML security controls. Additional protective measures include implementing XML validation filters, establishing rate limiting for client-state processing operations, and monitoring for unusual patterns in XML data consumption. Security configurations should enforce strict XML parsing policies that prevent entity expansion and ensure all external references are properly validated before processing. Network-level protections such as web application firewalls can provide additional defense-in-depth by filtering suspicious XML content at the perimeter.