CVE-2026-14865

EUVD-2026-47698
In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.
XML Entity Expansion
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 36.16%
Affected Products (NVD)
VendorProductVersion
progresstelerik_ui_for_asp.net_ajax
2009.31314 ≤
𝑥
< 2026.2.708
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rlb-xxe-injection-client-state-cve-2026-14865