A while ago I came across this CVE-2017-5461, which is rated 9.8 both on [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-5461) and [Redhat Portal](https://access.redhat.com/security/cve/cve-2017-5461), with a CVSS base string of 

> CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

for those who is not very familiar with CVSS scoring mechanism, let's break it apart, and I will elaborate my doubt following every element: 

 - AV:N means Attack Vector is Network, this is clear;
 - AC:L means Attack Complexity is Low, **Don't think so. as it require attacker to forge a special certificate.**
 - PR:N means privilege is not required.
 - UI:N means user(victim) interaction is uneeded.
 - S:U means Scope is unchanged.
 - C:H means *Confidentiality* Impact is high. no doubtedly.
 - I:H means *Integrity* Impact is high. we can agree on that.
 - A:H means *Availability* Impact is high. **how is this the case? why would a successful attempt break the availability of application?**

Do you think this vulnerability qualify for a Critical vulnerability?