{"id":"CVE-2026-111336","kind":"vulnerability","aliases":["CVE-2026-111336"],"related":[],"title":"Citrix NetScaler ADC and Gateway: HTTP/2 out-of-bounds write can crash the appliance or cause erratic behavior","description":"Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"A memory overflow in the HTTP/2 handling of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not state that an attacker can run code or read data.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC and Gateway","fixed":["14.1-73.57","13.1-64.39","14.1-73.58 FIPS","13.1-37.293 FIPS/NDcPP"],"affected":"14.1 before 14.1-73.57; 13.1 before 13.1-64.39; ADC 14.1-FIPS before 14.1-73.58; ADC 13.1-FIPS/NDcPP before 13.1-37.293","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix","http2","infrastructure","netscaler","netscaler-gateway","self-hosted"],"not_affected_if":["http2-disabled","managed-hosting"],"how_to_check":"Exposed if any HTTP or SSL type virtual server uses an HTTP profile with HTTP/2 enabled (check the HTTP profile bound to each vserver, e.g. 'show ns httpProfile' and look for HTTP2 ENABLED), and the build is older than the fixed versions (check with 'show ns version').","fix":"Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, ADC 14.1-FIPS 14.1-73.58 FIPS or later, or ADC 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later (CTX697305).","status":"open","published_at":"2026-11-13T08:17:15+00:00","first_seen_at":"2026-11-13T08:44:23+00:00","triaged_at":"2026-11-13T08:45:20+00:00","updated_at":"2026-11-13T08:47:10+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-13T08:45:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Citrix NetScaler: HTTP/2 memory overflow can crash the appliance or misbehave","impact":"low","summary":"A memory overflow in the HTTP/2 handling of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not state that an attacker can run code or read data.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["citrix","netscaler","netscaler-gateway","http2"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance crashes or behaves erratically, causing denial of service","analyst_note":"Check the NVD entry and Citrix security bulletin for affected and fixed NetScaler versions, and whether HTTP/2 must be enabled.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that run Citrix NetScaler ADC or NetScaler Gateway with HTTP/2 handling exposed to the network. The sources do not list affected versions or non-default settings. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":4529,"output_tokens":459,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Citrix security bulletin for affected and fixed NetScaler versions, and whether HTTP/2 must be enabled.","search":"'-111336':22A,25A '-2026':21A,24A 'adc':3A,27A,50B,96C 'and':28A 'applianc':15A 'attack':70B 'behavior':19A,57B,88C 'bound':10A 'caus':17A,55B 'citrix':1A,30B,48B,94C,98C 'code':73B 'crash':13A 'cve':20A,23A 'data':76B 'denial':60B,90C 'errat':18A 'erron':87C 'gateway':5A,29A,36B,53B,100C 'handl':46B,81C 'host':39B 'http/2':6A,45B,80C 'http2':31B 'infrastructur':32B 'lead':83C 'memori':41B,77C 'netscal':2A,33B,35B,49B,52B,95C,99C 'netscaler':26A 'netscaler-gateway':34B 'out-of-bound':7A 'overflow':42B,78C 'read':75B 'run':72B 'self':38B 'self-host':37B 'servic':62B,92C 'sourc':64B 'state':67B 'unpredict':56B,85C 'write':11A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed Citrix NetScaler ADC or Gateway with an HTTP or SSL virtual server whose HTTP profile has HTTP/2 enabled. Citrix describes the effect as unpredictable behavior or denial of service (CWE-787 out-of-bounds write); it does not state code execution. Appliances with HTTP/2 disabled in all bound profiles are not in the stated precondition.","tier":"B","verified":{"fix":{"at":"2026-11-13T08:47:10Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","run_id":3839},"how_to_check":{"at":"2026-11-13T08:47:10Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","run_id":3839},"who_affected":{"at":"2026-11-13T08:47:10Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","run_id":3839}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adcandgateway","netscaleradcandgateway"],"ptokens":["adc","and","gateway","netscaler"],"labels":["citrix","high","http2","infrastructure","netscaler","netscalergateway","selfhosted"],"campaign_type":null,"search_a":"'-111336':22A,25A '-2026':21A,24A 'adc':3A,27A 'and':28A 'applianc':15A 'behavior':19A 'bound':10A 'caus':17A 'citrix':1A 'crash':13A 'cve':20A,23A 'errat':18A 'gateway':5A,29A 'http/2':6A 'netscal':2A 'netscaler':26A 'out-of-bound':7A 'write':11A","search_b":"'adc':50B 'attack':70B 'behavior':57B 'caus':55B 'citrix':30B,48B 'code':73B 'data':76B 'denial':60B 'gateway':36B,53B 'handl':46B 'host':39B 'http/2':45B 'http2':31B 'infrastructur':32B 'memori':41B 'netscal':33B,35B,49B,52B 'netscaler-gateway':34B 'overflow':42B 'read':75B 'run':72B 'self':38B 'self-host':37B 'servic':62B 'sourc':64B 'state':67B 'unpredict':56B","search_c":"'adc':96C 'behavior':88C 'citrix':94C,98C 'denial':90C 'erron':87C 'gateway':100C 'handl':81C 'http/2':80C 'lead':83C 'memori':77C 'netscal':95C,99C 'overflow':78C 'servic':92C 'unpredict':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111336","severity":null,"published_at":"2026-11-13T08:17:15+00:00","modified_at":"2026-11-13T08:17:15+00:00","first_seen_at":"2026-11-13T08:44:23+00:00","fetched_at":"2026-11-13T08:44:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111336:3839","url":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","severity":null,"published_at":"2026-11-13T08:47:10+00:00","modified_at":"2026-11-13T08:47:10+00:00","first_seen_at":"2026-11-13T08:47:10+00:00","fetched_at":"2026-11-13T08:47:10+00:00","note":"Citrix CTX697305 (28-CVE bulletin, Nov 12 2026): precondition HTTP/SSL vserver with HTTP/2 in profile, CVSS4 8.3. Fixed versions read on vendor page; affected ranges taken from a rewrite (securityalert.ai) so product row unverified. No exploitation or PoC seen; no vendor workaround read on the page (a blog says none). Sibling CVEs in same bulletin.","cites":["https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","https://www.poppelgaard.com/ctx697305-and-cve-2026-120868-28-new-netscaler-vulnerabilities-what-you-should-know-and-how-to-fix-your-netscaler-adc-netscaler-gateway"]}],"documents":[{"id":142461,"url":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","title":"Citrix NetScaler ADC and NetScaler Gateway Security Bulletin (CTX697305)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":144158,"url":"https://www.poppelgaard.com/ctx697305-and-cve-2026-120868-28-new-netscaler-vulnerabilities-what-you-should-know-and-how-to-fix-your-netscaler-adc-netscaler-gateway","title":"Poppelgaard: 28 new NetScaler vulnerabilities (CTX697305)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}