CVE-2024-5491: Denial of Service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-10 · updated 2026-06-17

Description

Denial of Service in NetScaler ADC and NetScaler Gateway in NetScaler

Affected products

Citrix NetScaler ADC: from 12.1 before 13.0-92.31; from 13.1 before 13.1-53.17; from 14.1 before 14.1-25.53 — fixed in 13.0-92.31, 13.1-53.17, 14.1-25.53
Citrix Netscaler Application Delivery Controller Fips: from 12.1 before 12.1-55.304; from 13.1 before 13.1-37.183 — fixed in 12.1-55.304, 13.1-37.183
Citrix Netscaler Application Delivery Controller Ndcpp: from 12.1 before 12.1-55.304 — fixed in 12.1-55.304
Citrix NetScaler Gateway: from 12.1 before 13.0-92.31; from 13.1 before 13.1-53.17; from 14.1 before 14.1-25.53 — fixed in 13.0-92.31, 13.1-53.17, 14.1-25.53
Citrix NetScaler ADC: from 14.1 before 25.53; from 13.1 before 53.17; from 13.0 before 92.31; from 13.1-FIPS before 37.183; from 12.1-FIPS before 55.304; from 12.1-NDcPP before 55.304 — fixed in 25.53, 53.17, 92.31, 37.183, 55.304
Citrix NetScaler Gateway: from 14.1 before 25.53; from 13.1 before 53.17; from 13.0 before 92.31 — fixed in 25.53, 53.17, 92.31

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.0-92.31, 13.1-53.17, 14.1-25.53; Citrix Netscaler Application Delivery Controller Fips 12.1-55.304, 13.1-37.183; Citrix Netscaler Application Delivery Controller Ndcpp 12.1-55.304; Citrix NetScaler Gateway 13.0-92.31, 13.1-53.17, 14.1-25.53; Citrix NetScaler ADC 25.53, 53.17, 92.31, 37.183; Citrix NetScaler Gateway 25.53, 53.17, 92.31. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-5491 or the next vulnerability affects your stack