CVE-2026-111342

HighCVSS 8.7/10Last modified Nov 13, 2026

Description

Memory overflow in LDAP authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1113434.3pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other CVE-2026-1113444.3APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from o CVE-2026-1113454.3Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by su CVE-2026-1113465.4ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and ov CVE-2026-1113475.9go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords CVE-2026-1113485.4Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenti CVE-2026-1113495.3Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to CVE-2026-111356.5Insufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access CVE-2026-1113505.0Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to CVE-2026-1113514.2metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-pr CVE-2026-1113528.8ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administr CVE-2026-1113534.3Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attach