A while ago I came across this CVE-2017-5461, which is rated 9.8 both on NVD and Redhat Portal, with a CVSS base string of

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

for those who is not very familiar with CVSS scoring mechanism, let's break it apart, and I will elaborate my doubt following every element:

• AV:N means Attack Vector is Network, this is clear;
• AC:L means Attack Complexity is Low, Don't think so. as it require attacker to forge a special certificate.
• PR:N means privilege is not required.
• UI:N means user(victim) interaction is uneeded.
• S:U means Scope is unchanged.
• C:H means Confidentiality Impact is high. no doubtedly.
• I:H means Integrity Impact is high. we can agree on that.
• A:H means Availability Impact is high. how is this the case? why would a successful attempt break the availability of application?

Do you think this vulnerability qualify for a Critical vulnerability?