CVE-2026-13474

Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler

Score

CVSS 4.0 8.7 High

Status

Analyzed - 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

Published

2026-06-30

Last modified

2026-06-30

Weaknesses

CWE-401

Affected products

• Netscaler Application Delivery Controller (Citrix)
• Netscaler Gateway (Citrix)
• Adc (Netscaler)
• Gateway (Netscaler)

References

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604