Loading vulnerability…
SolarWinds Serv-U Unauthenticated Denial of Service
CVE-2026-28318 is an unauthenticated denial-of-service vulnerability in SolarWinds Serv-U 15.5.4 and earlier. Serv-U's web-interface HTTP request handling can process a POST request carrying a non-empty body and a Content-Encoding value of deflate before authentication. Under the default HTTP-compression configuration, a conditional rejection check is bypassed and the body reaches an in-memory decompression path. Faulty buffer management in that path causes an invalid free and heap-corruption detection terminates the Serv-U process. SolarWinds addressed the issue in Serv-U 15.5.4 Hotfix 1 by rejecting requests with a body and a non-empty Content-Encoding header before body processing.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote unauthenticated attacker can terminate the Serv-U service with a single low-complexity request, making managed file-transfer and related service functions unavailable. This can disrupt file transfers, automated integrations, and backup workflows. The reported CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). Analysis of the affected builds found practical impact to be service denial rather than remote code execution.
If you can’t patch tonight, do this now.
Until the update is deployed, block HTTP POST requests containing a Content-Encoding header at a reverse proxy, web application firewall, or other network control, as this functionality is not required by Serv-U. Restrict access to the Serv-U web interface to trusted source networks or addresses, reduce internet exposure, and monitor for anomalous POST requests using Content-Encoding: deflate and unexpected Serv-U process crashes or restarts.
Patch, then assume compromise.
Upgrade SolarWinds Serv-U to version 15.5.4 Hotfix 1 or later. The fixed release rejects POST requests with a body and a non-empty Content-Encoding header using HTTP 415 before the vulnerable decompression path is reached.
1 exploit validated by Mallory's analysis. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
94 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.