CVE-2025-3600 Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX
An unsafe reflection flaw in Telerik UI for ASP.NET AJAX allows attackers to crash the hosting process, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-3600?
CVE-2025-3600 is a high-severity denial of service vulnerability in Progress Software Telerik UI for ASP.NET AJAX, published on 14 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service.
Weakness: CWE-470
Which versions are affected by CVE-2025-3600?
It affects 1 product.
Products include Progress Telerik Ui for Asp.net Ajax.
How do I fix CVE-2025-3600?
No fix has been published for CVE-2025-3600 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-3600 being exploited?
There is no known exploitation of CVE-2025-3600 in the wild and no public exploit code.
Other vulnerabilities in Progress Software Telerik UI for ASP.NET AJAX
- CVE-2017-11357 Telerik UI for ASP.NET AJAX Insecure Direct Object Reference
- CVE-2021-28141 Missing authorization in n/a
- CVE-2019-19790 Path traversal in n/a
- CVE-2026-13181 RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13185 PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX
Sources
Also known as GHSA-8g7p-xh7p-947j.