{"id":"CVE-2026-107409","kind":"vulnerability","aliases":["CVE-2026-107409"],"related":[],"title":"NetScaler ADC and Gateway: double free in DNS-over-HTTPS load balancing causes crash or unpredictable behavior","description":"Memory corruption in DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or a Denial of Service in NetScaler ADC and NetScaler Gateway.","summary":"Citrix bulletin CTX697305 lists a memory corruption (CWE-415 double free) in DNS-over-HTTPS handling that can cause unpredictable or erroneous behavior or denial of service. It applies only when NetScaler is configured with DNS Load Balancing over HTTPS. Citrix does not say code execution is possible, and lists no exploitation.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57","13.1-64.39","14.1-FIPS 14.1-73.58","13.1-FIPS 13.1-37.293"],"affected":"14.1 < 14.1-73.57; 13.1 < 13.1-64.39; 14.1-FIPS < 14.1-73.58; 13.1-FIPS/13.1-NDcPP < 13.1-37.293","ecosystem":"vendor"},{"name":"NetScaler Gateway","fixed":["14.1-73.57","13.1-64.39"],"affected":"14.1 < 14.1-73.57; 13.1 < 13.1-64.39","ecosystem":"vendor"}],"ecosystems":[],"tags":["dns-over-https","infrastructure","netscaler","netscaler-gateway","network-appliance","self-hosted"],"not_affected_if":["doh-load-balancing-not-configured","managed-hosting","no-netscaler-deployment"],"how_to_check":"Check the NetScaler config for a DNS load balancing setup that serves DNS over HTTPS (DoH); Citrix's precondition is 'configured with DNS Load Balancing over HTTPS'. If none, you are not in the vulnerable configuration. Then compare the build (show version) with the fixed builds in CTX697305.","fix":"Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.","status":"open","published_at":"2026-11-13T02:18:49+00:00","first_seen_at":"2026-11-13T02:41:35+00:00","triaged_at":"2026-11-13T02:42:55+00:00","updated_at":"2026-11-13T02:44:03+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T02:42:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"NetScaler ADC: DNS-over-HTTPS memory corruption causes crashes or worse","impact":"high","summary":"NetScaler ADC and NetScaler Gateway have a memory corruption bug in their DNS-over-HTTPS (DoH) handling. The sources say it can cause unpredictable behavior or a denial of service; the sources do not state whether code execution is possible.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netscaler","netscaler-gateway","self-hosted","network-appliance"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"appliance crashes or behaves erratically; code execution not stated","analyst_note":"Find the vendor advisory (Citrix/NetScaler security bulletin) for affected and fixed firmware builds and whether DoH must be enabled; the NVD entry alone gives no versions.","how_to_check":"- Check whether DNS-over-HTTPS (DoH) is enabled on the NetScaler ADC or NetScaler Gateway appliance\n- Check the installed firmware build against the vendor's advisory\n- unknown for exact commands, the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-netscaler-deployment"],"who_is_affected":"NetScaler ADC and NetScaler Gateway appliances are affected, which are network devices that sit in front of company applications. The sources do not say whether the DoH feature must be enabled to be exposed, nor which firmware builds are vulnerable. Teams that do not run NetScaler products can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000761,"input_tokens":4534,"output_tokens":616,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory (Citrix/NetScaler security bulletin) for affected and fixed firmware builds and whether DoH must be enabled; the NVD entry alone gives no versions.","search":"'-107409':21A,24A '-2026':20A,23A '-415':52B 'adc':2A,26A,119C 'appli':73B 'applianc':40B 'balanc':13A,82B 'behavior':18A,67B,111C 'bulletin':45B 'caus':14A,63B 'citrix':44B,85B 'code':89B 'configur':78B 'corrupt':50B,98C 'crash':15A 'ctx697305':46B 'cve':19A,22A 'cwe':51B 'denial':69B,114C 'dns':9A,30B,57B,80B,101C 'dns-over-http':8A,29B,56B,100C 'doh':104C 'doubl':5A,53B 'erron':66B,110C 'execut':90B 'exploit':96B 'free':6A,54B 'gateway':4A,28A,37B,122C 'handl':60B 'host':43B 'https':11A,32B,59B,84B,103C 'infrastructur':33B 'lead':106C 'list':47B,94B 'load':12A,81B 'memori':49B,97C 'netscal':1A,34B,36B,76B,118C,121C 'netscaler':25A,27A 'netscaler-gateway':35B 'network':39B 'network-appli':38B 'possibl':92B 'say':88B 'self':42B 'self-host':41B 'servic':71B,116C 'unpredict':17A,64B,108C","nicknames":[],"mitigations":[],"who_affected":"NetScaler ADC and NetScaler Gateway appliances are affected, which are network devices that sit in front of company applications. The sources do not say whether the DoH feature must be enabled to be exposed, nor which firmware builds are vulnerable. Teams that do not run NetScaler products can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T02:44:03Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3802}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc","gateway","netscaleradc","netscalergateway"],"ptokens":["adc","gateway","netscaler"],"labels":["critical","dnsoverhttps","infrastructure","netscaler","netscalergateway","networkappliance","selfhosted"],"campaign_type":null,"search_a":"'-107409':21A,24A '-2026':20A,23A 'adc':2A,26A 'balanc':13A 'behavior':18A 'caus':14A 'crash':15A 'cve':19A,22A 'dns':9A 'dns-over-http':8A 'doubl':5A 'free':6A 'gateway':4A,28A 'https':11A 'load':12A 'netscal':1A 'netscaler':25A,27A 'unpredict':17A","search_b":"'-415':52B 'appli':73B 'applianc':40B 'balanc':82B 'behavior':67B 'bulletin':45B 'caus':63B 'citrix':44B,85B 'code':89B 'configur':78B 'corrupt':50B 'ctx697305':46B 'cwe':51B 'denial':69B 'dns':30B,57B,80B 'dns-over-http':29B,56B 'doubl':53B 'erron':66B 'execut':90B 'exploit':96B 'free':54B 'gateway':37B 'handl':60B 'host':43B 'https':32B,59B,84B 'infrastructur':33B 'list':47B,94B 'load':81B 'memori':49B 'netscal':34B,36B,76B 'netscaler-gateway':35B 'network':39B 'network-appli':38B 'possibl':92B 'say':88B 'self':42B 'self-host':41B 'servic':71B 'unpredict':64B","search_c":"'adc':119C 'behavior':111C 'corrupt':98C 'denial':114C 'dns':101C 'dns-over-http':100C 'doh':104C 'erron':110C 'gateway':122C 'https':103C 'lead':106C 'memori':97C 'netscal':118C,121C 'servic':116C 'unpredict':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T02:18:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107409","severity":null,"published_at":"2026-11-13T02:18:49+00:00","modified_at":"2026-11-13T02:18:49+00:00","first_seen_at":"2026-11-13T02:41:35+00:00","fetched_at":"2026-11-13T02:41:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107409:3802","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T02:44:03+00:00","modified_at":"2026-11-13T02:44:03+00:00","first_seen_at":"2026-11-13T02:44:03+00:00","fetched_at":"2026-11-13T02:44:03+00:00","note":"Citrix CTX697305: precondition is DNS LB over HTTPS, CWE-415; fixed builds listed. Affected ranges inferred as builds below fixed ones (circl shows 14.1 before 14.1-73.57); not verified. No exploitation or PoC seen; skipped social search.","cites":["https://support.citrix.com/external/article/CTX697305","https://www.heise.de/en/news/Attackers-can-take-Citrix-NetScaler-ADC-and-NetScaler-Gateway-offline-11523095.html"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin (CTX697305)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":142059,"url":"https://www.heise.de/en/news/Attackers-can-take-Citrix-NetScaler-ADC-and-NetScaler-Gateway-offline-11523095.html","title":"heise: Attackers can take Citrix NetScaler ADC and Gateway offline","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}