CVE-2026-13474

Published: Jun 30, 2026Modified: Jul 2, 2026

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5 (Secondary)

Description

Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler

Affected (7)

Products: Citrix: Netscaler Application Delivery Controller, Netscaler Gateway

Citrix

2 products

Netscaler Application Delivery Controller

Netscaler Gateway

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Citrix Netscaler Application Delivery Controller	From 13.1 to 13.1-63.18
Citrix Netscaler Application Delivery Controller	From 14.1 to 14.1-72.61
Citrix Netscaler Application Delivery Controller	Before 13.1-37.272
Citrix Netscaler Application Delivery Controller	Before 13.1-37.272
Citrix Netscaler Application Delivery Controller	Version 14.1-66.68
Citrix Netscaler Gateway	From 13.1 to 13.1-63.18
Citrix Netscaler Gateway	From 14.1 to 14.1-72.61

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (1)

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604

Source: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

Vendor Advisory

Timeline

No history available yet.