NETSCALER ADC · CVE-2026-120865 · Infrastructure
FIX → 14.1-73.57 ✓ verified
A memory overflow in the HTTP/3 (QUIC) handling of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not say that code execution or data theft is possible.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-managed NetScaler ADC and NetScaler Gateway appliances running a build older than the fixed ones are affected only if they have a load balancing or content switching virtual server of type HTTP_QUIC (HTTP/3). Appliances without such a vserver can skip it for this CVE, though the same bulletin lists many other CVEs. Citrix says the result can be unpredictable behavior or denial of service; it does not state code execution.
Not affected if http3-disabled, no-http-quic-vserver
Who cares citrix, gateway, http3, netscaler, quic, self-hosted
add lb vserver <name> HTTP_QUIC or add cs vserver <name> HTTP_QUICMemory overflow in HTTP/3 (QUIC) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
show versionUpgrade to 14.1-73.57
Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, ADC 14.1-FIPS 14.1-73.58 FIPS or later, or 13.1-FIPS/NDcPP 13.1-37.293 or later.