cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Citrix Patches NetScaler Flaws, Including HTTP/2 Bomb Vulnerability

· Original article ↗

Summary

Citrix released NetScaler ADC and Gateway updates addressing six vulnerabilities, including the HTTP/2 Bomb DoS flaw. watchTowr says CVE-2026-8451 can expose restricted memory under specific configuration and request conditions.

Key points

  • Citrix says updates for NetScaler ADC and NetScaler Gateway address six vulnerabilities, including the HTTP/2 Bomb denial-of-service flaw.
  • Citrix identifies CVE-2026-13474 as its NetScaler-specific identifier for HTTP/2 Bomb, also tracked as CVE-2026-49975.
  • watchTowr says CVE-2026-8451 affects NetScaler’s XML parser and can expose restricted memory in an HTTP response.
  • According to watchTowr, exploitation of CVE-2026-8451 requires a SAML identity provider configuration and a login request meeting specific conditions; a leaked data pointer could potentially aid full device compromise when combined with memory corruption.
  • Citrix says vulnerability preconditions vary by configuration and advises customers to check whether affected features are enabled.
  • Citrix lists fixes in NetScaler ADC and Gateway versions 14.1-72.61 and 13.1-63.18, with separate FIPS and NDcPP version updates.

Article Details

Vulnerability Types
  • Out-of-bounds read
  • Memory overflow
  • Arbitrary file read
  • Denial of service
Severity
High and medium; the article's severity assignment for CVE-2026-10816 is inconsistent.
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-10816Four of the issues, tracked as CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, and CVE-2026-10816, are high-severity out-of-bounds read, memory overflow, and arbitrary file read bugs.CVE-2026-13474Citrix assigned it a separate NetScaler-specific CVE identifier, CVE-2026-13474.CVE-2026-49975Tracked as CVE-2026-49975 and discovered using OpenAI’s Codex, HTTP/2 Bomb combines previously known attack techniques to knock web servers offline.CVE-2026-8451Four of the issues, tracked as CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, and CVE-2026-10816, are high-severity out-of-bounds read, memory overflow, and arbitrary file read bugs.CVE-2026-8452Four of the issues, tracked as CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, and CVE-2026-10816, are high-severity out-of-bounds read, memory overflow, and arbitrary file read bugs.CVE-2026-8655Four of the issues, tracked as CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, and CVE-2026-10816, are high-severity out-of-bounds read, memory overflow, and arbitrary file read bugs.

Vendors

CitrixCitrix on Tuesday announced fresh NetScaler ADC and NetScaler Gateway security updates that resolve six vulnerabilities, including the recent HTTP/2 Bomb flaw.

Products

Apache HTTP ServerTracked as CVE-2026-10816, the fifth is a medium-severity out-of-bounds read, while the sixth is HTTP/2 Bomb, a denial-of-service (DoS) exploit targeting Apache HTTP Server.NDcPPAll these weaknesses were addressed in NetScaler ADC and NetScaler Gateway versions 14.1-72.61 and 13.1-63.18, NetScaler ADC FIPS version 14.1-72.61 FIPS, and in NetScaler ADC FIPS and NDcPP version 13.1-37.272.NetScaler ADCCitrix on Tuesday announced fresh NetScaler ADC and NetScaler Gateway security updates that resolve six vulnerabilities, including the recent HTTP/2 Bomb flaw.NetScaler ADC FIPSAll these weaknesses were addressed in NetScaler ADC and NetScaler Gateway versions 14.1-72.61 and 13.1-63.18, NetScaler ADC FIPS version 14.1-72.61 FIPS, and in NetScaler ADC FIPS and NDcPP version 13.1-37.272.NetScaler GatewayCitrix on Tuesday announced fresh NetScaler ADC and NetScaler Gateway security updates that resolve six vulnerabilities, including the recent HTTP/2 Bomb flaw.

Tools

CodexTracked as CVE-2026-49975 and discovered using OpenAI’s Codex, HTTP/2 Bomb combines previously known attack techniques to knock web servers offline.

Related Articles