The vulnerability is an improper validation of an array index that is triggered when the vServer processes a malformed VATP packet. When an attacker crafts such a packet, the server can crash or become unresponsive, causing a denial of service. The flaw does not require authentication or elevated privileges; it can be exploited remotely by sending traffic to the affected server.

Velneo vServer versions 36.0 through 36.5 and 37.0 through 37.1 are affected. The vendor has released patched versions 36.6 and 37.2 that address the issue.

The CVSS score of 8.7 indicates a high severity level, and the severity is considered significant for services exposed to external networks. The EPSS score is not available, so the exact likelihood of exploitation is uncertain, but the lack of an effective workaround and the remote nature of the attack suggest a risk that attackers could use this vulnerability. The vulnerability is not listed in the CISA KEV catalog, but the impact potential warrants prompt remediation.