The vulnerability is located in the kernel of Oracle Solaris 11.4 and is triggered by specially crafted HTTP requests that an unauthenticated attacker can send over the network. When processed, the request exhausts kernel resources, causing the system to hang or repeatedly crash, resulting in a complete denial of service. The weakness corresponds to resource exhaustion and denial‑of‑service issues (CWE‑400) and has no direct effect on confidentiality or integrity.

Oracle Solaris 11.4 running on Oracle Corporation hardware is the only product version listed as affected. No other vendors or product lines are impacted according to the CNA data.

The CVSS base score of 7.5 labels the vulnerability as high severity, and the vector shows that a network attacker can exploit it with low effort and no authentication. The EPSS score of less than 1% indicates that, at the time of analysis, the probability of public exploitation is very low, and the vulnerability is not listed in CISA’s KEV catalog. However, because the attack can be performed remotely using only standard HTTP traffic, exposed Solaris hosts remain at risk of a full system crash if a malicious request is received.