NETSCALER ADC AND GATEWAY · CVE-2026-111336 · Infrastructure
FIX → 14.1-73.57 · 13.1-64.39 +2 ✓ verified
A memory overflow in the HTTP/2 handling of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not state that an attacker can run code or read data.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running self-managed Citrix NetScaler ADC or Gateway with an HTTP or SSL virtual server whose HTTP profile has HTTP/2 enabled. Citrix describes the effect as unpredictable behavior or denial of service (CWE-787 out-of-bounds write); it does not state code execution. Appliances with HTTP/2 disabled in all bound profiles are not in the stated precondition.
Not affected if http2-disabled, managed-hosting
Who cares citrix, http2, netscaler, netscaler-gateway, self-hosted
Exposed if any HTTP or SSL type virtual server uses an HTTP profile with HTTP/2 enabled (check the HTTP profile bound to each vserver, e.g. show ns httpProfile and look for HTTP2 ENABLED), and the build is older than the fixed versions (check with show ns version).
Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 14.1-73.57 · 13.1-64.39 +2
Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, ADC 14.1-FIPS 14.1-73.58 FIPS or later, or ADC 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later (CTX697305).