Progress Telerik RadAsyncUpload Timing Side-Channel Vulnerability (CVE-2026-13183)

Vulnerability Overview Vulnerability Name: RadAsyncUpload Upload Metadata Timing Oracle Vulnerability (CVE-2026-13183) Description: In Progress Telerik UI for AJAX versions 2026.2.519 and earlier, RadAsyncUpload's upload metadata processing may leak cryptographic validity through measurable time differences, allowing remote attackers to recover protected metadata values. Impact: Observable timing differences (CWE-208) and covert timing channels (CAPEC-385). Affected Versions Affected Versions: - 2019.1.309 through 2026.2.519 (2026 Q2) - Versions 2026.2.708 (2026 Q2 SP1) and later are not affected Remediation Recommended Action: Upgrade to the latest version. Specific Steps: - For versions v2026.2.514 and earlier: - Scenario 1: If is used in web.config: 1. Remove from web.config, reverting to MachineKey.Unprotect with AES + HMAC. 2. Continue to follow the instructions for generating strong machine keys. - Scenario 2: If is not used: 1. Continue to follow the instructions for generating strong machine keys. - For versions v2026.2.708 and later: - Option 1: You can use , as it provides stronger protection than the machineKey via AES-GCM. - Option 2: Remove and use the machineKey; although not as strong as GCM, this is useful in web farm environments and allows for "automatically generated keys at runtime." Additional Measures If RadAsyncUpload is not required, the handler can be disabled by setting to in the section of the web.config file. External References CVE-2026-13183 (High) CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5) Discovered By Justin Steven and Marcio Almeida of TantoSec Summary This vulnerability involves a timing side-channel attack in the metadata processing of RadAsyncUpload uploads. Upgrading to the latest version or implementing additional security measures is recommended to mitigate the risk.

Goal Reached Thanks to every supporter — we hit 100%!

Progress Telerik RadAsyncUpload Timing Side-Channel Vulnerability (CVE-2026-13183)