---
id: "CVE-2026-107409"
page: "https://infrastack.ai/live/CVE-2026-107409"
kind: "vulnerability"
aliases: ["CVE-2026-107409"]
title: "NetScaler ADC and Gateway: double free in DNS-over-HTTPS load balancing causes crash or unpredictable behavior"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NetScaler ADC", "fixed": ["14.1-73.57", "13.1-64.39", "14.1-FIPS 14.1-73.58", "13.1-FIPS 13.1-37.293"], "affected": "14.1 < 14.1-73.57; 13.1 < 13.1-64.39; 14.1-FIPS < 14.1-73.58; 13.1-FIPS/13.1-NDcPP < 13.1-37.293", "ecosystem": "vendor"}, {"name": "NetScaler Gateway", "fixed": ["14.1-73.57", "13.1-64.39"], "affected": "14.1 < 14.1-73.57; 13.1 < 13.1-64.39", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dns-over-https", "infrastructure", "netscaler", "netscaler-gateway", "network-appliance", "self-hosted"]
not_affected_if: ["doh-load-balancing-not-configured", "managed-hosting", "no-netscaler-deployment"]
published_at: "2026-11-13T02:18:49+00:00"
first_seen_at: "2026-11-13T02:41:35+00:00"
updated_at: "2026-11-13T02:44:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107409", "first_seen_at": "2026-11-13T02:41:35+00:00"}, {"source": "analyst", "url": "https://support.citrix.com/external/article/CTX697305", "first_seen_at": "2026-11-13T02:44:03+00:00", "cites": ["https://support.citrix.com/external/article/CTX697305", "https://www.heise.de/en/news/Attackers-can-take-Citrix-NetScaler-ADC-and-NetScaler-Gateway-offline-11523095.html"]}]
exploit_sources: []
---

# NetScaler ADC and Gateway: double free in DNS-over-HTTPS load balancing causes crash or unpredictable behavior

Link for people: https://infrastack.ai/live/CVE-2026-107409 (this .md is for agents)

Citrix bulletin CTX697305 lists a memory corruption (CWE-415 double free) in DNS-over-HTTPS handling that can cause unpredictable or erroneous behavior or denial of service. It applies only when NetScaler is configured with DNS Load Balancing over HTTPS. Citrix does not say code execution is possible, and lists no exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NetScaler ADC affected 14.1 < 14.1-73.57; 13.1 < 13.1-64.39; 14.1-FIPS < 14.1-73.58; 13.1-FIPS/13.1-NDcPP < 13.1-37.293 fixed 14.1-73.57, 13.1-64.39, 14.1-FIPS 14.1-73.58, 13.1-FIPS 13.1-37.293
- vendor:NetScaler Gateway affected 14.1 < 14.1-73.57; 13.1 < 13.1-64.39 fixed 14.1-73.57, 13.1-64.39

## How to check

Check the NetScaler config for a DNS load balancing setup that serves DNS over HTTPS (DoH); Citrix's precondition is 'configured with DNS Load Balancing over HTTPS'. If none, you are not in the vulnerable configuration. Then compare the build (show version) with the fixed builds in CTX697305.

## Fix

Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.

## Timeline

- 2026-11-13T02:41:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107409
- 2026-11-13T02:44:03+00:00 analyst https://support.citrix.com/external/article/CTX697305 — Citrix CTX697305: precondition is DNS LB over HTTPS, CWE-415; fixed builds listed. Affected ranges inferred as builds below fixed ones (circl shows 14.1 before 14.1-73.57); not verified. No exploitation or PoC seen; skipped social search.

## Documents

- [advisory] Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin (CTX697305) https://support.citrix.com/external/article/CTX697305
- [mentions] heise: Attackers can take Citrix NetScaler ADC and Gateway offline https://www.heise.de/en/news/Attackers-can-take-Citrix-NetScaler-ADC-and-NetScaler-Gateway-offline-11523095.html

## From the sources

Memory corruption in DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or a Denial of Service in NetScaler ADC and NetScaler Gateway.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_