SolarWinds Serv-U DoS Bug Lets Unauthenticated Requests Crash Exposed Web Interfaces

SolarWinds Serv-U versions 15.5.4.108 and earlier are affected by CVE-2026-28318, an unauthenticated denial-of-service flaw that can crash the service through the default-enabled web interface. Bishop Fox reported that a single POST request carrying a Content-Encoding: deflate header and any body can trigger heap corruption caused by an invalid free() in the product’s in-memory decompressor, aborting the Serv-U process. Although the bug initially raised concern about possible memory-corruption exploitation, testing found the practical impact to be service availability loss rather than remote code execution.

SolarWinds addressed the issue in Serv-U 15.5.4 HF1 by rejecting requests that include a body and a non-empty Content-Encoding header with HTTP 415 before the body is processed; patched builds are identified as 15.5.4.125 or later. Bishop Fox also published a production-safe detection tool on GitHub that avoids sending the crashing input and instead checks for the 415 response using a benign request, while warning that reverse proxies or load balancers may affect results. Organizations are advised to upgrade to 15.5.4 HF1 or later, block POST requests with Content-Encoding headers at a WAF or reverse proxy, and limit Serv-U web interface exposure to trusted networks until patching is complete.