A flaw in the Solaris 11.4 kernel permits an unauthenticated network actor to send a crafted HTTP request that triggers a kernel panic or system hang, resulting in a complete denial of service. The vulnerability results from a lack of proper bounds checking on input received over HTTP, leading to a memory corruption that terminates critical kernel processes. The impact is limited to availability; confidentiality and integrity are not compromised. The CVSS 3.1 base score of 7.5 reflects a high severity for availability effects and indicates a low exploitation difficulty.

The only systems affected are those running Oracle Solaris 11.4. No other Solaris releases are impacted by CVE‑2026‑91255 as noted in Oracle’s security advisory.

The EPSS score of less than 1 % suggests that attacks exploiting this flaw are unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is over the network via HTTP; an unauthenticated adversary can trigger the crash by sending the malformed request, with no need for privileged access or lateral movement.