The vulnerability CVE-2026-14865 in Progress Telerik UI for ASP.NET AJAX arises because the internal LayoutBuilder control processes XML client-state data without disabling Document Type Definition (DTD) processing. This improper restriction of recursive entity references (CWE-776) enables an unauthenticated attacker to trigger a denial of service condition by exploiting recursive XML entity expansion. The affected version explicitly identified is 2009.1.314. The CVSS v3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability (denial of service). No official fix or patch has been published as of the data provided.

An unauthenticated attacker can cause a denial of service by sending crafted XML data that triggers recursive entity expansion in the vulnerable LayoutBuilder control. This leads to resource exhaustion on the affected system, impacting availability. There is no confidentiality or integrity impact reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor Progress Software advisories for updates. As a temporary measure, consider disabling DTD processing in XML parsers if configurable or applying XML entity expansion limits if possible within the application environment.