Actively Exploited SolarWinds Serv-U DoS Flaw Crashes Web Interface
Active Exploitation · 3 sources · Updated 4mo ago · First seen Jul 6, 2026
SolarWinds Serv-U is affected by CVE-2026-28318, a high-severity unauthenticated denial-of-service flaw in the product’s web interface that has been added to CISA’s Known Exploited Vulnerabilities catalog after active exploitation was confirmed in the wild. The bug can be triggered with a single crafted POST request that includes the Content-Encoding: deflate header and any non-empty body, leading to heap corruption and a crash of the Serv-U process.
Research cited in public reporting found the issue stems from a logic error that bypasses Serv-U’s deflate rejection check when HTTP compression is enabled by default, making the vulnerability a practical crash vector rather than a realistic route to remote code execution. SolarWinds addressed the flaw in Serv-U 15.5.4 HF1 by rejecting requests with a non-empty Content-Encoding header before request-body processing, and defenders were advised they can safely identify patched systems by checking whether a POST request using Content-Encoding: identity returns HTTP 415.
