High · 7.5 CVE-2026-13183 EUVD-2026-47688GHSA-c5xq-jjwj-x369

RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX

Published Jul 22, 2026 · Updated Jul 22, 2026 · Assigned by ProgressSoftware

Vendor: Progress Software Product: Telerik UI for ASP.NET AJAX

Description

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values.

Affected products

Vendor	Product	Affected	Fixed
Progress Software	Telerik UI for ASP.NET AJAX	2010.1.309 – < 2026.2.708	2026.2.708

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-timing-oracle-CVE-2026-13183 vendor-advisory