Heuristic: Malformed DTLS record length on NetScaler:443 (CVE-2026-88772)
This rule detects potentially malformed or truncated DTLS records on NetScaler appliances, specifically on port 443. The rule looks for packets with a specific record length configuration that may indicate a buffer overflow or other exploitation attempt targeting CVE-2026-88772. The detection logic relies on analyzing the DTLS handshake sequence and packet sizing, and the rule authors recommend correlating these events with SSL_HANDSHAKE_FAILURE (DTLSv1.0, Handshake failure-Internal Error) and appliance crash log entries to confirm potential exploitation.
Suricata
