---
id: "CVE-2026-120862"
page: "https://infrastack.ai/live/CVE-2026-120862"
kind: "vulnerability"
aliases: ["CVE-2026-120862"]
title: "Citrix NetScaler: memory overflow in SIP ALG and DNS logging causes denial of service"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Citrix NetScaler", "fixed": ["14.1-73.57"], "affected": "< 14.1-73.57", "ecosystem": "vendor"}, {"name": "Citrix NetScaler 13.1", "fixed": ["13.1-64.39"], "affected": "< 13.1-64.39", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["citrix-netscaler", "denial-of-service", "infrastructure", "network-appliance", "self-hosted"]
not_affected_if: ["dns-answer-logging-disabled", "dns-logging-disabled", "sip-alg-disabled"]
published_at: "2026-11-13T08:17:16+00:00"
first_seen_at: "2026-11-13T08:44:24+00:00"
updated_at: "2026-11-13T08:46:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120862", "first_seen_at": "2026-11-13T08:44:24+00:00"}, {"source": "analyst", "url": "https://support.citrix.com/external/article/CTX697305", "first_seen_at": "2026-11-13T08:46:07+00:00", "cites": ["https://support.citrix.com/external/article/CTX697305"]}]
exploit_sources: []
---

# Citrix NetScaler: memory overflow in SIP ALG and DNS logging causes denial of service

Link for people: https://infrastack.ai/live/CVE-2026-120862 (this .md is for agents)

A memory overflow in the SIP ALG (LSN) and DNS answer-section logging code paths of Citrix NetScaler can cause unpredictable or erroneous behavior. The likely outcome for an attacker is a denial of service on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Citrix NetScaler affected < 14.1-73.57 fixed 14.1-73.57
- vendor:Citrix NetScaler 13.1 affected < 13.1-64.39 fixed 13.1-64.39

## How to check

Exposed only if SIP ALG is enabled on an LSN group (look for -sipalg ENABLED in 'show lsn group' / the running config) or DNS answer-section security logging is enabled in a DNS profile (-dnsanswerSecLogging ENABLED, including default-dns-profile). Then compare the running build (show version) with the fixed builds.

## Fix

Upgrade NetScaler ADC/Gateway to 14.1-73.57 or later (14.1), 13.1-64.39 or later (13.1); 14.1-FIPS to 14.1-73.58 FIPS or later; 13.1-FIPS and 13.1-NDcPP to 13.1-37.293 or later.

## Timeline

- 2026-11-13T08:44:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120862
- 2026-11-13T08:46:07+00:00 analyst https://support.citrix.com/external/article/CTX697305 — Read Citrix bulletin CTX697305: precondition and fixed builds confirmed on vendor page; no mitigations listed; no exploitation stated. Affected 'before' ranges from vendor-page summary plus Kraft Kennedy, so products not marked verified. X/posts not searched (DoS bulletin, 28 CVEs).

## Documents

- [advisory] Citrix NetScaler ADC and Gateway Security Bulletin CTX697305 https://support.citrix.com/external/article/CTX697305

## From the sources

Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_