Saint CitrixBleed 3, Third of the Bleeding Line

Patron of gateways published to the internet, sessions stolen from memory, and franchise sequels.

Life

In March 2026 CVE-2026-3055 was disclosed, called CitrixBleed 3 as the direct heir of CitrixBleed and CitrixBleed 2. On NetScaler appliances configured as SAML identity providers, a malformed request made the response hand back kilobytes of process memory, which could hold session tokens, SAML assertions and credentials. No authentication, no interaction. CISA added it to the catalogue of exploited vulnerabilities.

Prayer

O Saint CitrixBleed 3, who makes the gateway's memory bleed, keep our parsers from telling what lies beside them. Amen.

How to celebrate

Celebrated by applying Citrix's patches, invalidating active sessions, and taking off the internet the gateways that can stay off it.

Third sequel, same wound, fewer excuses.