---
id: "CVE-2026-107408"
page: "https://infrastack.ai/live/CVE-2026-107408"
kind: "vulnerability"
aliases: ["CVE-2026-107408"]
title: "NetScaler ADC and Gateway: DNS/DoH out-of-bounds write can crash the appliance"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NetScaler ADC", "fixed": ["14.1-73.57", "13.1-64.39", "14.1-73.58 FIPS", "13.1-37.293 FIPS/NDcPP"], "affected": "14.1 < 14.1-73.57; 13.1 < 13.1-64.39; 14.1-FIPS < 14.1-73.58; 13.1-FIPS/NDcPP < 13.1-37.293", "ecosystem": "vendor"}, {"name": "NetScaler Gateway", "fixed": ["14.1-73.57", "13.1-64.39"], "affected": "14.1 < 14.1-73.57; 13.1 < 13.1-64.39", "ecosystem": "vendor"}]
ecosystems: []
tags: ["citrix", "dns", "doh", "gateway", "infrastructure", "netscaler", "self-hosted"]
not_affected_if: ["no-dns-load-balancing", "not-netscaler", "recursion-disabled"]
published_at: "2026-11-13T02:18:49+00:00"
first_seen_at: "2026-11-13T02:41:35+00:00"
updated_at: "2026-11-13T02:45:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107408", "first_seen_at": "2026-11-13T02:41:35+00:00"}, {"source": "analyst", "url": "https://support.citrix.com/external/article/CTX697305", "first_seen_at": "2026-11-13T02:45:28+00:00", "cites": ["https://support.citrix.com/external/article/CTX697305"]}]
exploit_sources: []
---

# NetScaler ADC and Gateway: DNS/DoH out-of-bounds write can crash the appliance

Link for people: https://infrastack.ai/live/CVE-2026-107408 (this .md is for agents)

Citrix bulletin CTX697305 describes memory corruption (CWE-787 out-of-bounds write) in DNS and DNS-over-HTTPS handling that can cause unpredictable behavior or denial of service. Citrix rates it CVSS v4 9.3. Citrix's precondition is NetScaler ADC configured for DNS load balancing and recursive DNS resolution. The bulletin does not say whether code execution is possible and does not mention exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NetScaler ADC affected 14.1 < 14.1-73.57; 13.1 < 13.1-64.39; 14.1-FIPS < 14.1-73.58; 13.1-FIPS/NDcPP < 13.1-37.293 fixed 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS, 13.1-37.293 FIPS/NDcPP
- vendor:NetScaler Gateway affected 14.1 < 14.1-73.57; 13.1 < 13.1-64.39 fixed 14.1-73.57, 13.1-64.39

## How to check

Check the build: 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58, 13.1-FIPS/NDcPP before 13.1-37.293 is affected. Then look in the config for 'set dns parameter -recursion ENABLED' or 'add dns profile <name> -recursiveResolution ENABLED', together with a DNS proxy vserver: 'add lb|cs vserver <name> DNS|DNS_TCP|DOT ...' or 'add lb|cs vserver <name> SSL ... -dnsOverHttps ENABLED'.

## Fix

Upgrade to 14.1-73.57 or later, 13.1-64.39 or later, 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later. Citrix lists no workaround.

## Timeline

- 2026-11-13T02:41:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107408
- 2026-11-13T02:45:28+00:00 analyst https://support.citrix.com/external/article/CTX697305 — Read Citrix bulletin CTX697305: precondition is DNS load balancing plus recursive resolution (CWE-787 OOB write); fixed builds listed. No mitigation stated; no exploitation or PoC found.

## Documents

- [advisory] Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin (CTX697305) https://support.citrix.com/external/article/CTX697305

## From the sources

Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_