A remote attacker who does not need to authenticate can trigger a configured HPE NonStop ANSI SQLUTIL instance to terminate unexpectedly. The resulting crash leads to a temporary loss of service, which can impact availability for users that rely on the database function. The weakness is rooted in improper input handling, which allows an unfettered request to bring the service down.

The vulnerability affects Hewlett Packard Enterprise’s HPE NonStop ANSI SQLUTIL service. No specific version information is provided, so all releases may be at risk unless otherwise noted by the vendor.

The CVSS score of 7.5 indicates a high severity for availability impacts, while the EPSS score of lower than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, and the attack appears to be network-based, requiring the ability to connect to the SQLUTIL service. Because no authentication is required, the attacker can succeed from any remote location that can reach the service endpoint.