CVE-2026-13474: Denial of service via malformed HTTP/2 requests
Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable HTTP/2 in the HTTP Profile when it is enabled and associated with the affected LB/CS/VPN virtual server type or the NetScaler service.
NetScaler ADC / NetScaler Gateway HTTP/2 enablement in HTTP Profile (bound to LB/CS/VPN virtual server or NetScaler service) = disable
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13474?
CVE-2026-13474 has a risk score of 37, indicating a moderate severity level.
How do I fix CVE-2026-13474?
To remediate CVE-2026-13474, disable HTTP/2 support in the HTTP Profile associated with the affected virtual server or service on NetScaler.
What types of services are affected by CVE-2026-13474?
CVE-2026-13474 affects services configured on NetScaler of type Load Balancer (LB), Content Switching (CS), and VPN.
What vulnerability does CVE-2026-13474 describe?
CVE-2026-13474 describes a denial of service vulnerability that can be triggered by malformed HTTP/2 requests.
When was CVE-2026-13474 published?
CVE-2026-13474 was published on June 30, 2026.