CVE-2026-13474— Denial of service via malformed HTTP/2 requests

AI Predicted 7.5 Difficulty: Easy EPSS 0.40% · P32 Updated Jul 02, 2026

Possible ATT&CK Techniques 1AI

Affected Version Matrix 6

Vendor	Product	Version Range	Status
NetScaler	ADC	`14.1< 72.61`	affected
		`13.1< 63.18`	affected
		`14.1 FIPS< 72.61`	affected
		`13.1 FIPS and NDcPP< 37.272`	affected
NetScaler	Gateway	`14.1< 72.61`	affected
		`13.1< 63.18`	affected

Get alerts for future matching vulnerabilitiesLog in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Denial of service via malformed HTTP/2 requests

Source: NVD (National Vulnerability Database)

Vulnerability Description

Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler

Source: NVD (National Vulnerability Database)

CVSS Information

N/A

Source: NVD (National Vulnerability Database)

Vulnerability Type

在移除最后引用时对内存的释放不恰当(内存泄露)

Source: NVD (National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
NetScaler	ADC	14.1 ~ 72.61	-
NetScaler	Gateway	14.1 ~ 72.61	-

II. Public POCs for CVE-2026-13474

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2026-13474

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-13474 (1)

🔗 CITRIX | Support

https://nvd.nist.gov/vuln/detail/CVE-2026-13474

Same Patch Batch · NetScaler · 2026-06-30 · 6 CVEs total

CVE-2026-10817		Insufficient input validation leading to memory overread
CVE-2026-10816		Arbitrary File Read (Unauthenticated)
CVE-2026-8452		Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of
CVE-2026-8655		Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior an
CVE-2026-8451		Insufficient input validation leading to memory overread

IV. Related Vulnerabilities

Same product: ADC

Same vendor: NetScaler

Same weakness: CWE-401

V. Comments for CVE-2026-13474

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-13474— Denial of service via malformed HTTP/2 requests

Possible ATT&CK Techniques 1AI

Affected Version Matrix 6

I. Basic Information for CVE-2026-13474

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-13474

III. Intelligence Information for CVE-2026-13474

Vendor Advisories for CVE-2026-13474 (1)

Same Patch Batch · NetScaler · 2026-06-30 · 6 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-13474

Leave a comment