CVE-2026-106137 is a race condition vulnerability in Progress Telerik UI for ASP.NET MVC versions from 2012.2.710 up to but not including 2026.3.1015. The issue involves unsafe updates to a shared class dictionary without exclusive write protection, leading to potential corruption or resource exhaustion. An unauthenticated remote attacker can exploit this by sending concurrent crafted requests to an exposed aggregation endpoint, causing increased CPU and memory usage and potentially degrading application availability. The vulnerability is fixed in version 2026.3.1015.