CVE-2026-6022

High

Published: 22 April 2026

Published

22 April 2026

Modified

05 May 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0022 44.2th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-6022 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Progress Telerik Ui For Asp.Net Ajax. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 44.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Flaw remediation requires updating Telerik UI for AJAX to 2026.1.421 or later, which enforces cumulative size limits during chunk reassembly to prevent disk space exhaustion.

SC-5 Denial-of-service Protection good match

prevent

Denial-of-service protection implements mechanisms to limit effects of resource exhaustion attacks from oversized chunked file uploads.

SC-6 Resource Availability good match

prevent

Resource availability employs allocation mechanisms to protect disk space from unauthorized consumption by bypassing per-chunk size limits.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Vulnerability directly enables remote exploitation of a public-facing application component to cause excessive disk resource consumption and denial of service via application or system exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.

Deeper analysisAI

CVE-2026-6022 is an uncontrolled resource consumption vulnerability (CWE-400) in the RadAsyncUpload component of Progress® Telerik® UI for AJAX versions prior to 2026.1.421. The issue arises from a lack of cumulative size enforcement during chunk reassembly, allowing uploaded files to exceed configured maximum size limits. This can lead to disk space exhaustion on affected systems. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact with no requirements for privileges or user interaction.

Attackers can exploit this vulnerability remotely over the network with low complexity. Any unauthenticated user who can reach an affected RadAsyncUpload endpoint may send specially crafted chunked upload requests that bypass per-chunk size checks, resulting in excessive disk usage and potential denial-of-service through resource exhaustion. Successful exploitation requires no special privileges or user interaction, making it accessible to remote attackers.

Telerik has published a knowledge base article detailing the issue at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-6022. Mitigation involves updating to Telerik UI for AJAX 2026.1.421 or later, which enforces proper cumulative size limits during chunk reassembly. Security practitioners should verify deployments, apply patches promptly, and consider network-level upload restrictions as interim measures.