This vulnerability (CVE-2026-13474) affects NetScaler ADC and NetScaler Gateway products when HTTP/2 is enabled in the HTTP Profile and linked to virtual servers of type load balancing (LB), content switching (CS), VPN, or the configured services. Malformed HTTP/2 requests can cause a denial of service due to improper memory management, specifically a missing release of memory after its effective lifetime (CWE-401). The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. No official patch or remediation level has been provided by the vendor as of the published date.

Successful exploitation can cause denial of service on affected NetScaler ADC and Gateway devices by exhausting memory resources through malformed HTTP/2 requests. This can disrupt availability of services relying on these devices, impacting load balancing, content switching, or VPN functionalities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling HTTP/2 in the HTTP Profile if feasible to mitigate exposure to this vulnerability. Monitor vendor communications for updates on patches or official mitigations.