CVE-2026-14865

Katalog CVE

CVSS 5.3 · Medium EPSS 0,43%

Kerentanan Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') pada progress telerik ui for asp.net ajax. Skor CVSS 3.1 5.3 (Medium) menurut progress.com.

Deskripsi (NVD)

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.

Rincian

Terbit di NVD

22 Juli 2026

Terakhir diubah

6 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber progress.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rlb-xxe-injection-client... advisory vendor · mitigasi