CVE-2026-13474: NetScaler ADC and Gateway HTTP/2 Denial of Service Vulnerability

Technical summary

The vulnerability stems from improper handling of malformed HTTP/2 frames in NetScaler's HTTP profile configuration. When HTTP/2 is enabled on a virtual server (load balancing, content switching, or VPN type) or associated service, the appliance fails to correctly validate or process certain HTTP/2 request structures, leading to resource exhaustion or process termination. The flaw is classified under CWE-401 (Missing Release of Memory after Effective Lifetime), suggesting inadequate cleanup of HTTP/2 session state when processing invalid frames.

Business impact

Affected organizations face potential service degradation or complete unavailability of critical load-balancing and gateway functions. Since NetScaler ADC typically sits at the network perimeter handling ingress traffic, a successful denial-of-service attack could disrupt customer-facing applications, internal service routing, and VPN access. Recovery requires manual intervention and appliance restart, extending downtime.

Affected systems

Citrix NetScaler ADC and NetScaler Gateway installations with HTTP/2 enabled in the HTTP Profile and associated to any virtual server (LB, CS, or VPN type) or service are vulnerable. Organizations running HTTP/2-disabled configurations are not affected. Verify your HTTP profile settings in the virtual server and service configurations to determine exposure.

Exploitability

This vulnerability requires no authentication, no special privileges, and no user interaction—only network access to the affected appliance. The attack vector is network-based and the attack complexity is low, meaning an attacker with basic HTTP/2 crafting capability can trigger the denial of service. No KEV (Known Exploited Vulnerability) status has been assigned as of the published date, but the straightforward nature of malformed-request attacks suggests weaponization risk is moderate to high.

Remediation

Citrix will release patched versions of NetScaler ADC and NetScaler Gateway that properly validate and handle malformed HTTP/2 frames. Organizations should apply security updates as soon as they become available. As an interim measure, consider disabling HTTP/2 in the HTTP Profile if business operations permit, or restricting network access to the appliance to trusted sources only.

Patch guidance

Monitor Citrix's security advisory channels for patched versions specific to your NetScaler ADC or Gateway release train. Verify patch compatibility with your current configuration before deployment. Test updates in a non-production environment first, as HTTP/2 handling changes may affect performance or connection behavior. Once patches are available, prioritize deployment given the ease of exploitation and potential for business disruption.

Detection guidance

Monitor NetScaler logs for unusual HTTP/2 frame processing errors, sudden process restarts, or resource spikes coinciding with inbound HTTP/2 traffic. Network-based detection systems should flag malformed HTTP/2 frames (invalid frame headers, oversized payloads, or protocol violations) sent to your appliance. Establish baseline HTTP/2 traffic patterns to detect anomalous request volumes from single sources.

Why prioritize this

This vulnerability merits high-priority remediation due to its high CVSS score (7.5), ease of exploitation (no authentication required, low complexity), and direct impact on application availability. NetScaler appliances are critical infrastructure; their compromise or unavailability cascades to dependent systems. The lack of KEV status should not delay action—straightforward DoS techniques are typically exploited quickly once public details emerge.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication barrier, no user interaction needed, and a direct denial-of-service impact. The attack surface is large—any HTTP/2-enabled virtual server or service is a potential target. The integrity and confidentiality impacts are none, limiting the score from critical, but the availability impact is high. Organizations running NetScaler should treat this as a significant risk to business continuity.

Frequently asked questions