{"id":"CVE-2026-111339","kind":"vulnerability","aliases":["CVE-2026-111339"],"related":[],"title":"Citrix NetScaler: memory overflow in firewall decompression can crash appliance","description":"Memory overflow in Application Firewall data decompression/inspection can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"Citrix NetScaler ADC and NetScaler Gateway have a memory overflow in the Application Firewall when it decompresses and inspects data. The sources say it can cause unpredictable or erroneous behavior or a denial of service.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["application-firewall","citrix","infrastructure","netscaler","self-hosted"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T08:17:16+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","triaged_at":"2026-11-13T08:45:23+00:00","updated_at":"2026-11-13T08:45:23+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-13T08:45:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Citrix NetScaler: memory overflow in firewall decompression can crash appliance","impact":"medium","summary":"Citrix NetScaler ADC and NetScaler Gateway have a memory overflow in the Application Firewall when it decompresses and inspects data. The sources say it can cause unpredictable or erroneous behavior or a denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netscaler","citrix","application-firewall","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance crashes or behaves unpredictably, causing denial of service","analyst_note":"Find affected and fixed NetScaler versions and whether Application Firewall must be enabled, from the Citrix security bulletin for CVE-2026-111339.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Citrix NetScaler ADC or NetScaler Gateway with the Application Firewall feature in use. The sources do not say which versions or configurations are affected, so the exact exposure is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":4525,"output_tokens":464,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111339':13A,16A '-2026':12A,15A 'adc':28B,82C 'applianc':10A 'applic':18B,38B,64C 'application-firewal':17B 'behavior':55B,74C 'caus':51B 'citrix':1A,20B,26B,80C,84C 'crash':9A 'cve':11A,14A 'data':45B,66C 'decompress':7A,42B 'decompression/inspection':67C 'denial':58B,76C 'erron':54B,73C 'firewal':6A,19B,39B,65C 'gateway':31B,86C 'host':25B 'infrastructur':21B 'inspect':44B 'lead':69C 'memori':3A,34B,61C 'netscal':2A,22B,27B,30B,81C,85C 'overflow':4A,35B,62C 'say':48B 'self':24B 'self-host':23B 'servic':60B,78C 'sourc':47B 'unpredict':52B,71C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Citrix NetScaler ADC or NetScaler Gateway with the Application Firewall feature in use. The sources do not say which versions or configurations are affected, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["applicationfirewall","citrix","infrastructure","medium","netscaler","selfhosted"],"campaign_type":null,"search_a":"'-111339':13A,16A '-2026':12A,15A 'applianc':10A 'citrix':1A 'crash':9A 'cve':11A,14A 'decompress':7A 'firewal':6A 'memori':3A 'netscal':2A 'overflow':4A","search_b":"'adc':28B 'applic':18B,38B 'application-firewal':17B 'behavior':55B 'caus':51B 'citrix':20B,26B 'data':45B 'decompress':42B 'denial':58B 'erron':54B 'firewal':19B,39B 'gateway':31B 'host':25B 'infrastructur':21B 'inspect':44B 'memori':34B 'netscal':22B,27B,30B 'overflow':35B 'say':48B 'self':24B 'self-host':23B 'servic':60B 'sourc':47B 'unpredict':52B","search_c":"'adc':82C 'applic':64C 'behavior':74C 'citrix':80C,84C 'data':66C 'decompression/inspection':67C 'denial':76C 'erron':73C 'firewal':65C 'gateway':86C 'lead':69C 'memori':61C 'netscal':81C,85C 'overflow':62C 'servic':78C 'unpredict':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111339","severity":null,"published_at":"2026-11-13T08:17:16+00:00","modified_at":"2026-11-13T08:17:16+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","fetched_at":"2026-11-13T08:44:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}