{"id":"CVE-2026-107408","kind":"vulnerability","aliases":["CVE-2026-107408"],"related":[],"title":"NetScaler ADC and Gateway: DNS/DoH out-of-bounds write can crash the appliance","description":"Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.","summary":"Citrix bulletin CTX697305 describes memory corruption (CWE-787 out-of-bounds write) in DNS and DNS-over-HTTPS handling that can cause unpredictable behavior or denial of service. Citrix rates it CVSS v4 9.3. Citrix's precondition is NetScaler ADC configured for DNS load balancing and recursive DNS resolution. The bulletin does not say whether code execution is possible and does not mention exploitation.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57","13.1-64.39","14.1-73.58 FIPS","13.1-37.293 FIPS/NDcPP"],"affected":"14.1 < 14.1-73.57; 13.1 < 13.1-64.39; 14.1-FIPS < 14.1-73.58; 13.1-FIPS/NDcPP < 13.1-37.293","ecosystem":"vendor"},{"name":"NetScaler Gateway","fixed":["14.1-73.57","13.1-64.39"],"affected":"14.1 < 14.1-73.57; 13.1 < 13.1-64.39","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix","dns","doh","gateway","infrastructure","netscaler","self-hosted"],"not_affected_if":["no-dns-load-balancing","not-netscaler","recursion-disabled"],"how_to_check":"Check the build: 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58, 13.1-FIPS/NDcPP before 13.1-37.293 is affected. Then look in the config for 'set dns parameter -recursion ENABLED' or 'add dns profile <name> -recursiveResolution ENABLED', together with a DNS proxy vserver: 'add lb|cs vserver <name> DNS|DNS_TCP|DOT ...' or 'add lb|cs vserver <name> SSL ... -dnsOverHttps ENABLED'.","fix":"Upgrade to 14.1-73.57 or later, 13.1-64.39 or later, 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later. Citrix lists no workaround.","status":"open","published_at":"2026-11-13T02:18:49+00:00","first_seen_at":"2026-11-13T02:41:35+00:00","triaged_at":"2026-11-13T02:42:52+00:00","updated_at":"2026-11-13T02:45:28+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-13T02:42:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"NetScaler ADC and Gateway: DNS memory corruption enables denial of service","impact":"medium","summary":"Memory corruption in the DNS and DNS-over-HTTPS handling of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not state whether code execution is possible.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netscaler","citrix","self-hosted","gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"appliance crashes or behaves unpredictably; denial of service","analyst_note":"Check the Citrix/NetScaler security bulletin for affected versions, fixed builds and whether DNS or DoH must be enabled.","how_to_check":"- Check the NetScaler ADC and Gateway firmware build on the appliance, against the affected ranges in the vendor advisory.\n- Check whether DNS or DNS-over-HTTPS features are enabled in the configuration.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-netscaler"],"who_is_affected":"NetScaler ADC and NetScaler Gateway appliances that handle DNS or DNS-over-HTTPS traffic are exposed. Teams not running these appliances can skip it. The sources do not list the exact affected versions or configurations.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000727,"input_tokens":4539,"output_tokens":546,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Citrix/NetScaler security bulletin for affected versions, fixed builds and whether DNS or DoH must be enabled.","search":"'-107408':17A,20A '-2026':16A,19A '-787':41B '9.3':69B 'adc':2A,22A,75B,122C 'applianc':14A 'balanc':80B 'behavior':59B,115C 'bound':9A,45B 'bulletin':35B,86B 'caus':57B 'citrix':25B,34B,64B,70B 'code':91B 'configur':76B 'corrupt':39B,101C 'crash':12A 'ctx697305':36B 'cve':15A,18A 'cvss':67B 'cwe':40B 'denial':61B,117C 'describ':37B 'dns':26B,48B,51B,78B,83B,103C,105C 'dns-over-http':50B,104C 'dns/doh':5A 'doh':27B,108C 'erron':114C 'execut':92B 'exploit':99B 'gateway':4A,24A,28B,125C 'handl':54B 'host':33B 'https':53B,107C 'infrastructur':29B 'lead':110C 'load':79B 'memori':38B,100C 'mention':98B 'netscal':1A,30B,74B,121C,124C 'netscaler':21A,23A 'out-of-bound':6A,42B 'possibl':94B 'precondit':72B 'rate':65B 'recurs':82B 'resolut':84B 'say':89B 'self':32B 'self-host':31B 'servic':63B,119C 'unpredict':58B,112C 'v4':68B 'whether':90B 'write':10A,46B","nicknames":[],"mitigations":[],"who_affected":"Self-managed NetScaler ADC appliances (and Gateway builds on the same releases) running an affected build and configured for DNS load balancing with recursive DNS resolution, including DNS-over-HTTPS vservers. Appliances without DNS recursion and DNS vservers do not meet Citrix's precondition, and teams without NetScaler can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T02:45:28Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3803},"products":{"at":"2026-11-13T02:45:28Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3803},"how_to_check":{"at":"2026-11-13T02:45:28Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3803},"who_affected":{"at":"2026-11-13T02:45:28Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3803}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc","gateway","netscaleradc","netscalergateway"],"ptokens":["adc","gateway","netscaler"],"labels":["citrix","critical","dns","doh","gateway","infrastructure","netscaler","selfhosted"],"campaign_type":null,"search_a":"'-107408':17A,20A '-2026':16A,19A 'adc':2A,22A 'applianc':14A 'bound':9A 'crash':12A 'cve':15A,18A 'dns/doh':5A 'gateway':4A,24A 'netscal':1A 'netscaler':21A,23A 'out-of-bound':6A 'write':10A","search_b":"'-787':41B '9.3':69B 'adc':75B 'balanc':80B 'behavior':59B 'bound':45B 'bulletin':35B,86B 'caus':57B 'citrix':25B,34B,64B,70B 'code':91B 'configur':76B 'corrupt':39B 'ctx697305':36B 'cvss':67B 'cwe':40B 'denial':61B 'describ':37B 'dns':26B,48B,51B,78B,83B 'dns-over-http':50B 'doh':27B 'execut':92B 'exploit':99B 'gateway':28B 'handl':54B 'host':33B 'https':53B 'infrastructur':29B 'load':79B 'memori':38B 'mention':98B 'netscal':30B,74B 'out-of-bound':42B 'possibl':94B 'precondit':72B 'rate':65B 'recurs':82B 'resolut':84B 'say':89B 'self':32B 'self-host':31B 'servic':63B 'unpredict':58B 'v4':68B 'whether':90B 'write':46B","search_c":"'adc':122C 'behavior':115C 'corrupt':101C 'denial':117C 'dns':103C,105C 'dns-over-http':104C 'doh':108C 'erron':114C 'gateway':125C 'https':107C 'lead':110C 'memori':100C 'netscal':121C,124C 'servic':119C 'unpredict':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T02:18:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107408","severity":null,"published_at":"2026-11-13T02:18:49+00:00","modified_at":"2026-11-13T02:18:49+00:00","first_seen_at":"2026-11-13T02:41:35+00:00","fetched_at":"2026-11-13T02:41:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107408:3803","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T02:45:28+00:00","modified_at":"2026-11-13T02:45:28+00:00","first_seen_at":"2026-11-13T02:45:28+00:00","fetched_at":"2026-11-13T02:45:28+00:00","note":"Read Citrix bulletin CTX697305: precondition is DNS load balancing plus recursive resolution (CWE-787 OOB write); fixed builds listed. No mitigation stated; no exploitation or PoC found.","cites":["https://support.citrix.com/external/article/CTX697305"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin (CTX697305)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}