{"id":"CVE-2026-107411","kind":"vulnerability","aliases":["CVE-2026-107411"],"related":[],"title":"Citrix NetScaler ADC: memory overflow in RTSP ALG can cause denial of service (RTSP LB vserver or LSN RTSP ALG)","description":"Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler","summary":"Citrix bulletin CTX697305 lists CVE-2026-107411, a memory overflow in RTSP ALG that can cause unpredictable behavior or denial of service (CWE-119, CVSS v4.0 8.7, availability impact only, network, no auth). It applies only to NetScaler ADC configured with a Load Balancing virtual server of type RTSP, or with RTSP ALG enabled on an LSN group. The bulletin does not say it is exploited.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler ADC 14.1-FIPS","fixed":["14.1-73.58"],"affected":"< 14.1-73.58","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1-FIPS and NDcPP","fixed":["13.1-37.293"],"affected":"< 13.1-37.293","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix","dos","infrastructure","netscaler","self-hosted"],"not_affected_if":["no-lsn-rtsp-alg","no-rtsp-vserver","rtsp-alg-disabled"],"how_to_check":"1) Run 'show ns version' and compare with the fixed builds. 2) Check the config for an LB vserver of type RTSP (e.g. 'show lb vserver' and look for RTSP) or RTSP ALG enabled on an LSN group (e.g. 'show lsn group'). Neither is exposed if both are absent. The vendor's own check instructions were not read.","fix":"Upgrade to 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/NDcPP 13.1-37.293 or later.","status":"open","published_at":"2026-11-13T03:17:28+00:00","first_seen_at":"2026-11-13T03:42:55+00:00","triaged_at":"2026-11-13T03:43:18+00:00","updated_at":"2026-11-13T03:44:59+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-13T03:43:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Citrix NetScaler: RTSP ALG memory overflow enables denial of service","impact":"medium","summary":"A memory overflow in the RTSP application layer gateway of Citrix NetScaler can cause unpredictable behavior or a denial of service. The sources do not state an attacker-controlled code execution path.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netscaler","citrix","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance crashes or behaves erratically, causing denial of service","analyst_note":"Confirm affected NetScaler versions, fixed releases and whether RTSP ALG must be enabled, from the NVD entry and Citrix security bulletin.","how_to_check":"- Check whether RTSP ALG is enabled on the NetScaler appliance (unknown setting name in the sources)\n- Compare the running NetScaler firmware version against the fixed versions in the vendor advisory (unknown in the sources)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["rtsp-alg-disabled"],"who_is_affected":"NetScaler appliances that process RTSP traffic through the application layer gateway are the systems to look at. The sources do not describe the exact configuration required, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4511,"output_tokens":518,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected NetScaler versions, fixed releases and whether RTSP ALG must be enabled, from the NVD entry and Citrix security bulletin.","search":"'-107411':23A,26A,55B '-119':72B '-2026':22A,25A,54B '13.1':31A,38A '14.1':34A '8.7':75B 'adc':3A,28A,30A,33A,37A,87B 'alg':8A,20A,61B,101B,119C 'and':40A 'appli':83B 'auth':81B 'avail':76B 'balanc':92B 'behavior':66B,126C 'bulletin':50B,108B 'caus':10A,64B 'citrix':1A,42B,49B,132C 'configur':88B 'ctx697305':51B 'cve':21A,24A,53B 'cvss':73B 'cwe':71B 'denial':11A,68B,128C 'dos':43B 'enabl':102B 'erron':125C 'exploit':114B 'fips':35A,39A 'group':106B 'host':48B 'impact':77B 'infrastructur':44B 'lb':15A 'lead':121C 'list':52B 'load':91B 'lsn':18A,105B 'memori':4A,57B,115C 'ndcpp':41A 'netscal':2A,45B,86B,133C 'netscaler':27A,29A,32A,36A 'network':79B 'overflow':5A,58B,116C 'rtsp':7A,14A,19A,60B,97B,100B,118C 'say':111B 'self':47B 'self-host':46B 'server':94B 'servic':13A,70B,130C 'type':96B 'unpredict':65B,123C 'v4.0':74B 'virtual':93B 'vserver':16A","nicknames":[],"mitigations":[],"who_affected":"NetScaler ADC appliances (self-managed) that run a Load Balancing virtual server of type RTSP, or RTSP ALG on an LSN group, on 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58, or 13.1-FIPS/NDcPP before 13.1-37.293. Appliances without an RTSP vserver or LSN RTSP ALG meet no precondition in the bulletin.","tier":"B","verified":{"fix":{"at":"2026-11-13T03:44:59Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","run_id":3815},"products":{"at":"2026-11-13T03:44:59Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","run_id":3815},"who_affected":{"at":"2026-11-13T03:44:59Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","run_id":3815}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc","adc131","adc131fipsandndcpp","adc141fips","netscaleradc","netscaleradc131","netscaleradc131fipsandndcpp","netscaleradc141fips"],"ptokens":["13","14","adc","and","fips","ndcpp","netscaler"],"labels":["citrix","dos","high","infrastructure","netscaler","selfhosted"],"campaign_type":null,"search_a":"'-107411':23A,26A '-2026':22A,25A '13.1':31A,38A '14.1':34A 'adc':3A,28A,30A,33A,37A 'alg':8A,20A 'and':40A 'caus':10A 'citrix':1A 'cve':21A,24A 'denial':11A 'fips':35A,39A 'lb':15A 'lsn':18A 'memori':4A 'ndcpp':41A 'netscal':2A 'netscaler':27A,29A,32A,36A 'overflow':5A 'rtsp':7A,14A,19A 'servic':13A 'vserver':16A","search_b":"'-107411':55B '-119':72B '-2026':54B '8.7':75B 'adc':87B 'alg':61B,101B 'appli':83B 'auth':81B 'avail':76B 'balanc':92B 'behavior':66B 'bulletin':50B,108B 'caus':64B 'citrix':42B,49B 'configur':88B 'ctx697305':51B 'cve':53B 'cvss':73B 'cwe':71B 'denial':68B 'dos':43B 'enabl':102B 'exploit':114B 'group':106B 'host':48B 'impact':77B 'infrastructur':44B 'list':52B 'load':91B 'lsn':105B 'memori':57B 'netscal':45B,86B 'network':79B 'overflow':58B 'rtsp':60B,97B,100B 'say':111B 'self':47B 'self-host':46B 'server':94B 'servic':70B 'type':96B 'unpredict':65B 'v4.0':74B 'virtual':93B","search_c":"'alg':119C 'behavior':126C 'citrix':132C 'denial':128C 'erron':125C 'lead':121C 'memori':115C 'netscal':133C 'overflow':116C 'rtsp':118C 'servic':130C 'unpredict':123C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107411","severity":null,"published_at":"2026-11-13T03:17:28+00:00","modified_at":"2026-11-13T03:17:28+00:00","first_seen_at":"2026-11-13T03:42:55+00:00","fetched_at":"2026-11-13T03:42:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107411:3815","url":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","severity":null,"published_at":"2026-11-13T03:44:59+00:00","modified_at":"2026-11-13T03:44:59+00:00","first_seen_at":"2026-11-13T03:44:59+00:00","fetched_at":"2026-11-13T03:44:59+00:00","note":"Read Citrix bulletin CTX697305: precondition, affected/fixed versions confirmed. Bulletin text I got was truncated, so the vendor's own how-to-check command is not read; no exploitation or PoC stated. X and posts not searched.","cites":["https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html"]}],"documents":[{"id":142461,"url":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","title":"Citrix NetScaler ADC and Gateway Security Bulletin (CTX697305)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}