When we walked through CitrixBleed 2 earlier this year, we treated it as one bug in one product. Step back and it is plainly not that. It is the latest entry in a lineage of memory-disclosure vulnerabilities in perimeter appliances that runs back more than a decade, and the lineage is worth looking at directly, because the pattern predicts the next one better than any single CVSS score does.
A short family tree
The archetype is Heartbleed (CVE-2014-0160): a missing bounds check in OpenSSL’s TLS heartbeat let an attacker read adjacent process memory, including private keys and session data, by asking for more bytes than they supplied. The mechanism, not the product, is the thing to hold onto. An attacker sends input that the code trusts to describe a length, and the code returns memory it never meant to expose.
That mechanism kept reappearing at the network edge. CitrixBleed (CVE-2023-4966) in 2023 was an over-read in NetScaler ADC and Gateway that leaked session tokens straight out of appliance memory. CitrixBleed 2 (CVE-2025-5777) in 2025 was the same class in the same product family: insufficient validation of attacker-controlled input leading to an out-of-bounds read of memory that should never have crossed the trust boundary. Alongside them, the 2024 and 2025 waves against Ivanti Connect Secure and various SSL-VPN and firewall management planes carried more than one information-disclosure primitive of the same shape. Different vendors, one bug class.
Why edge appliances keep producing this bug
This is not bad luck, and it is not any single vendor being careless. Four structural facts push toward it:
- These devices are written in memory-unsafe languages, overwhelmingly C, in codebases that predate the current appliance and were never rewritten.
- They parse fully attacker-controlled input, TLS handshakes and HTTP requests, before any authentication has happened. The most exposed code runs earliest.
- They hold exactly the material an attacker wants, live session tokens and credentials, in the same process memory that the parser can be tricked into disclosing.
- They sit at the perimeter, which means every organisation trusts them, exposes them to the internet by design, and cannot easily put another control in front of them.
Put those together and a memory-disclosure bug in a perimeter appliance is not an information leak in the abstract. It is a pre-authentication read of the one region of memory that contains the keys to the building.
Why the CVSS number understates it
We are on record as skeptical of CVSS used as triage policy, and this class is a clean example of why. Scored as “confidentiality impact,” a memory read looks like a partial-information problem. In practice, when the memory being read contains valid session tokens, the confidentiality bug is an authentication-bypass bug wearing a lower-severity label. The attacker does not need the password or the second factor; they lift a session that already cleared both. The number on the advisory measures the mechanism. The consequence is account takeover on the device that fronts everything else.
The part defenders miss: patching does not undo the leak
The single most important operational point about this class, and the one that turned CitrixBleed in 2023 into months of follow-on intrusions, is that the patch stops future leaks but does nothing about the material already taken. Session tokens exfiltrated before the update remain valid after it. An organisation that patched and moved on was still compromisable with credentials that were harvested the week before.
So the response to any bug in this family has a mandatory second step that is easy to skip under deadline pressure:
- Patch, obviously and quickly, because the appliance is internet-facing and being scanned.
- Then rotate everything the appliance held: terminate all active sessions, force re-authentication, and roll any secrets or keys that lived in that memory. A patch you applied on Friday does not invalidate a token stolen on Wednesday.
- Hunt backward for reuse of pre-patch sessions from unfamiliar addresses, because that is what the intrusions after the fix actually looked like.
What this predicts
There will be another one. It will be in a perimeter appliance, it will be an out-of-bounds or uninitialised read in a pre-auth code path, it will be scored as information disclosure, and it will functionally be an authentication bypass because of what that memory holds. Treating these products as what they are, internet-exposed memory-unsafe code holding live credentials, is a more useful posture than reacting to each CVE as a surprise. The name changes. The bug class has been stable since 2014.