This CVE presents an integer underflow in a non-default configuration path that requires an authenticated session to trigger, resulting in a persistent denial-of-service. The CVSS of 6.1 is misleading for defenders running 24/7 access infrastructure—once exploited, the underflow corrupts a shared lifecycle struct governing server state for all active sessions, meaning the DoS doesn't self-heal on retry. This isn't a crash-and-recover scenario; it requires human intervention to remediate, making the operational impact closer to a 9.0 for teams that cannot tolerate partial outages in their VPN or gateway infrastructure.
The authentication requirement is doing dangerous double duty in the threat model. It functions as both a technical constraint and a risk-normalization signal—engineers unconsciously read 'authenticated' as 'realistic threat is hypothetical,' which extends the remediation timeline. Historical data shows integer underflow DoS bugs scoring 5.0-6.9 in access infrastructure take weeks to months to patch, compared to days for 8.0+ issues, precisely because the medium-severity label signals 'defer' in organizational triage.
Audit priority: don't just patch this instance. The underflow almost certainly originated from a copy-paste operation from a well-reviewed 'happy path' handler—likely the session initialization or configuration parsing module. The pattern of integer operations on user-controlled length fields feeding into structs that control cross-session resource management is the blast radius multiplier. Look specifically for those operations in configuration handlers that aren't the default path, because the vendor's own language ('non-default configuration') is a confession that auditing stopped where the happy path ended. The next vulnerability in this codebase will live in another non-default path using the same integer operation template on a length field—same copy-paste family, different protocol option. The real exposure window isn't measured from disclosure to patch; it's measured from when this configuration path stopped being the default. That clock has been running longer than anyone realizes.