---
id: "CVE-2026-111336"
page: "https://infrastack.ai/live/CVE-2026-111336"
kind: "vulnerability"
aliases: ["CVE-2026-111336"]
title: "Citrix NetScaler ADC and Gateway: HTTP/2 out-of-bounds write can crash the appliance or cause erratic behavior"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NetScaler ADC and Gateway", "fixed": ["14.1-73.57", "13.1-64.39", "14.1-73.58 FIPS", "13.1-37.293 FIPS/NDcPP"], "affected": "14.1 before 14.1-73.57; 13.1 before 13.1-64.39; ADC 14.1-FIPS before 14.1-73.58; ADC 13.1-FIPS/NDcPP before 13.1-37.293", "ecosystem": "vendor"}]
ecosystems: []
tags: ["citrix", "http2", "infrastructure", "netscaler", "netscaler-gateway", "self-hosted"]
not_affected_if: ["http2-disabled", "managed-hosting"]
published_at: "2026-11-13T08:17:15+00:00"
first_seen_at: "2026-11-13T08:44:23+00:00"
updated_at: "2026-11-13T08:47:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111336", "first_seen_at": "2026-11-13T08:44:23+00:00"}, {"source": "analyst", "url": "https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html", "first_seen_at": "2026-11-13T08:47:10+00:00", "cites": ["https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html", "https://www.poppelgaard.com/ctx697305-and-cve-2026-120868-28-new-netscaler-vulnerabilities-what-you-should-know-and-how-to-fix-your-netscaler-adc-netscaler-gateway"]}]
exploit_sources: []
---

# Citrix NetScaler ADC and Gateway: HTTP/2 out-of-bounds write can crash the appliance or cause erratic behavior

Link for people: https://infrastack.ai/live/CVE-2026-111336 (this .md is for agents)

A memory overflow in the HTTP/2 handling of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not state that an attacker can run code or read data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NetScaler ADC and Gateway affected 14.1 before 14.1-73.57; 13.1 before 13.1-64.39; ADC 14.1-FIPS before 14.1-73.58; ADC 13.1-FIPS/NDcPP before 13.1-37.293 fixed 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS, 13.1-37.293 FIPS/NDcPP

## How to check

Exposed if any HTTP or SSL type virtual server uses an HTTP profile with HTTP/2 enabled (check the HTTP profile bound to each vserver, e.g. 'show ns httpProfile' and look for HTTP2 ENABLED), and the build is older than the fixed versions (check with 'show ns version').

## Fix

Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, ADC 14.1-FIPS 14.1-73.58 FIPS or later, or ADC 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later (CTX697305).

## Timeline

- 2026-11-13T08:44:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111336
- 2026-11-13T08:47:10+00:00 analyst https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html — Citrix CTX697305 (28-CVE bulletin, Nov 12 2026): precondition HTTP/SSL vserver with HTTP/2 in profile, CVSS4 8.3. Fixed versions read on vendor page; affected ranges taken from a rewrite (securityalert.ai) so product row unverified. No exploitation or PoC seen; no vendor workaround read on the page (a blog says none). Sibling CVEs in same bulletin.

## Documents

- [advisory] Citrix NetScaler ADC and NetScaler Gateway Security Bulletin (CTX697305) https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html
- [mentions] Poppelgaard: 28 new NetScaler vulnerabilities (CTX697305) https://www.poppelgaard.com/ctx697305-and-cve-2026-120868-28-new-netscaler-vulnerabilities-what-you-should-know-and-how-to-fix-your-netscaler-adc-netscaler-gateway

## From the sources

Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_