CVE Explorer
CVE-2026-13183
In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"Telerik UI for ASP.NET AJAX","vendor":"Progress Software","versions":[{"lessThan":"2026.2.708","status":"affected","version":"2010.1.309","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:dff5eb48f0f53fa32d258571528048a820731a8c9296bda765442945abaf4a0e · sha256:009b75add4552d5f… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:dff5eb48f0f53fa32d258571528048a820731a8c9296bda765442945abaf4a0e · sha256:009b75add4552d5f… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-208","description":"CWE-208 Observable Timing Discrepancy","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:dff5eb48f0f53fa32d258571528048a820731a8c9296bda765442945abaf4a0e · sha256:009b75add4552d5f… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"tags":["vendor-advisory"],"url":"https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-timing-oracle-CVE-2026-13183"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:dff5eb48f0f53fa32d258571528048a820731a8c9296bda765442945abaf4a0e · sha256:009b75add4552d5f… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.