{"id":"CVE-2026-120862","kind":"vulnerability","aliases":["CVE-2026-120862"],"related":[],"title":"Citrix NetScaler: memory overflow in SIP ALG and DNS logging causes denial of service","description":"Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler","summary":"A memory overflow in the SIP ALG (LSN) and DNS answer-section logging code paths of Citrix NetScaler can cause unpredictable or erroneous behavior. The likely outcome for an attacker is a denial of service on the appliance.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Citrix NetScaler","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"Citrix NetScaler 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["citrix-netscaler","denial-of-service","infrastructure","network-appliance","self-hosted"],"not_affected_if":["dns-answer-logging-disabled","dns-logging-disabled","sip-alg-disabled"],"how_to_check":"Exposed only if SIP ALG is enabled on an LSN group (look for -sipalg ENABLED in 'show lsn group' / the running config) or DNS answer-section security logging is enabled in a DNS profile (-dnsanswerSecLogging ENABLED, including default-dns-profile). Then compare the running build (show version) with the fixed builds.","fix":"Upgrade NetScaler ADC/Gateway to 14.1-73.57 or later (14.1), 13.1-64.39 or later (13.1); 14.1-FIPS to 14.1-73.58 FIPS or later; 13.1-FIPS and 13.1-NDcPP to 13.1-37.293 or later.","status":"open","published_at":"2026-11-13T08:17:16+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","triaged_at":"2026-11-13T08:45:13+00:00","updated_at":"2026-11-13T08:46:07+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-13T08:45:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Citrix NetScaler: memory overflow in SIP ALG and DNS logging causes denial of service","impact":"medium","summary":"A memory overflow in the SIP ALG (LSN) and DNS answer-section logging code paths of Citrix NetScaler can cause unpredictable or erroneous behavior. The likely outcome for an attacker is a denial of service on the appliance.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["citrix-netscaler","self-hosted","network-appliance"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance crashes or behaves unpredictably, causing denial of service","analyst_note":"Find the vendor advisory for CVE-2026-120862 to confirm affected versions, the fixed release and whether the flaw is reachable from the internet; the NVD entry alone does not say.","how_to_check":"- Check whether SIP ALG (LSN) or DNS answer-section logging is enabled on the NetScaler; the sources do not give the setting name.\n- Compare the running NetScaler firmware version with the affected ranges in the vendor advisory; the sources do not list them.","plain_action":"","product_name":"Citrix NetScaler","needs_analyst":true,"not_affected_if":["sip-alg-disabled","dns-logging-disabled"],"who_is_affected":"NetScaler appliances that run the SIP ALG (LSN) or DNS answer-section logging features are the likely exposure, based on the flawed code paths named in the description. The sources do not state which versions or configurations are affected, so teams that do not run these features may be able to skip it, but this is unverified.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000777,"input_tokens":4528,"output_tokens":648,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory for CVE-2026-120862 to confirm affected versions, the fixed release and whether the flaw is reachable from the internet; the NVD entry alone does not say.","search":"'-120862':17A,20A '-2026':16A,19A '13.1':25A 'alg':7A,46B,83C 'answer':51B,88C 'answer-sect':50B,87C 'applianc':36B,78B 'attack':70B 'behavior':64B,98C 'caus':11A,60B 'citrix':1A,21A,23A,27B,57B,104C 'citrix-netscal':26B 'code':54B 'cve':15A,18A 'datapath':91C 'denial':12A,30B,73B,100C 'denial-of-servic':29B 'dns':9A,49B,86C 'erron':63B,97C 'host':39B 'infrastructur':33B 'lead':93C 'like':66B 'log':10A,53B,90C 'lsn':47B,84C 'memori':3A,41B,79C 'netscal':2A,28B,58B,105C 'netscaler':22A,24A 'network':35B 'network-appli':34B 'outcom':67B 'overflow':4A,42B,80C 'path':55B 'section':52B,89C 'self':38B 'self-host':37B 'servic':14A,32B,75B,102C 'sip':6A,45B,82C 'unpredict':61B,95C","nicknames":[],"mitigations":[],"who_affected":"NetScaler ADC and NetScaler Gateway appliances (self-managed) on 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58, and 13.1-FIPS/NDcPP before 13.1-37.293 are affected, but Citrix says the flaw is only reachable when SIP ALG is enabled on an LSN group or DNS answer-section security logging is enabled in a DNS profile. Appliances with neither feature enabled can skip it. Citrix lists the impact as denial of service or erratic behaviour; CVSS v4 8.7, network-reachable with no authentication.","tier":"B","verified":{"fix":{"at":"2026-11-13T08:46:07Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3835},"how_to_check":{"at":"2026-11-13T08:46:07Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3835},"who_affected":{"at":"2026-11-13T08:46:07Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3835}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["citrixnetscaler","citrixnetscaler131","netscaler","netscaler131"],"ptokens":["13","citrix","netscaler"],"labels":["citrixnetscaler","denialofservice","high","infrastructure","networkappliance","selfhosted","vendor"],"campaign_type":null,"search_a":"'-120862':17A,20A '-2026':16A,19A '13.1':25A 'alg':7A 'caus':11A 'citrix':1A,21A,23A 'cve':15A,18A 'denial':12A 'dns':9A 'log':10A 'memori':3A 'netscal':2A 'netscaler':22A,24A 'overflow':4A 'servic':14A 'sip':6A","search_b":"'alg':46B 'answer':51B 'answer-sect':50B 'applianc':36B,78B 'attack':70B 'behavior':64B 'caus':60B 'citrix':27B,57B 'citrix-netscal':26B 'code':54B 'denial':30B,73B 'denial-of-servic':29B 'dns':49B 'erron':63B 'host':39B 'infrastructur':33B 'like':66B 'log':53B 'lsn':47B 'memori':41B 'netscal':28B,58B 'network':35B 'network-appli':34B 'outcom':67B 'overflow':42B 'path':55B 'section':52B 'self':38B 'self-host':37B 'servic':32B,75B 'sip':45B 'unpredict':61B","search_c":"'alg':83C 'answer':88C 'answer-sect':87C 'behavior':98C 'citrix':104C 'datapath':91C 'denial':100C 'dns':86C 'erron':97C 'lead':93C 'log':90C 'lsn':84C 'memori':79C 'netscal':105C 'overflow':80C 'section':89C 'servic':102C 'sip':82C 'unpredict':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120862","severity":null,"published_at":"2026-11-13T08:17:16+00:00","modified_at":"2026-11-13T08:17:16+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","fetched_at":"2026-11-13T08:44:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120862:3835","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T08:46:07+00:00","modified_at":"2026-11-13T08:46:07+00:00","first_seen_at":"2026-11-13T08:46:07+00:00","fetched_at":"2026-11-13T08:46:07+00:00","note":"Read Citrix bulletin CTX697305: precondition and fixed builds confirmed on vendor page; no mitigations listed; no exploitation stated. Affected 'before' ranges from vendor-page summary plus Kraft Kennedy, so products not marked verified. X/posts not searched (DoS bulletin, 28 CVEs).","cites":["https://support.citrix.com/external/article/CTX697305"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin CTX697305","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}