# CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)

NetScaler SAML IdP XML attribute parser fails to treat newline as terminator for unquoted values, overreading past the request buffer and leaking memory via the NSC_TASS cookie.

- Payout: Research
- Severity: high
- Program: Citrix NetScaler
- Credited: Aliz Hammond
- Disclosed: 2026-06-30
- CVE: CVE-2026-8451
- Write-up quality: 8/10
- Original: https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451/
- Library page: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451
- Tags: domain:web impact:data-leak impact:dos kind:research platform:research sev:high tech:saml technique:fuzzing technique:source-review vuln:dos vuln:info-disclosure vuln:memory-corruption

**Target:** /saml/login SAML AuthnRequest XML attribute parser (nsppe)
**Root cause:** Custom XML attribute parser only treats whitespace as terminator for quoted values; unquoted values terminate only on NUL, '>', or quote, so a newline-terminated attribute keeps scanning past the buffer end with no bounds check.
**Steps:**
1. Configure NetScaler as SAML IdP; POST base64 SAMLRequest to `/saml/login`.
2. Send `<samlp:AuthnRequest Version="2.0" AssertionConsumerServiceURL=` with newline-terminated unquoted value and unterminated start tag, plus a valid `<saml:Issuer>`.
3. Observe `/var/log/ns.log` showing acs value consuming subsequent XML past the newline.
4. Move Issuer outside AuthnRequest and leave AssertionConsumerServiceURL= empty at end of buffer to force read past request end.
5. Decode returned `NSC_TASS` cookie to recover leaked heap bytes (0xdeadbeef fill, pointer-like values).
6. Vary request length to leak a few bytes per request; minimal `ID=` request crashes nsppe.
**How found:** While reproducing CVE-2026-3055, reviewed the custom XML attribute parser and noticed no bounds checks and inconsistent termination logic (whitespace terminates quoted but not unquoted values). Tested newline-terminated unquoted attributes against /saml/login, tailing ns.log to observe overread, then moved attributes to end of buffer to read past request.
**Exploitation:** Unauthenticated attacker sends crafted SAMLRequest to /saml/login; parser overreads past XML buffer and embeds leaked memory into the NSC_TASS cookie returned in the 302 response, yielding a few bytes of heap per request. Repeated requests with varying lengths leak memory contents; a truncated `ID=` request crashes the nsppe process (DoS).
**Escalation:** Leaked pointer-like values could serve as an infoleak primitive to chain with a memory corruption bug for full device compromise; also trivially DoS via crash.
**Insight:** When auditing custom XML/attribute parsers, compare termination rules between quoted and unquoted value paths — a newline that terminates one path but not the other lets you extend a value past its intended end and, by placing the attribute last, past the buffer entirely; watch logs/cookies for reflected parsed values to confirm overread.