Loading vulnerability…
CVE-2026-28318 is a high-severity unauthenticated denial-of-service vulnerability in SolarWinds Serv-U affecting versions up to and including 15.5.4, fixed in 15.5.4 Hotfix 1 / build 15.5.4.125. The issue is reachable through the Serv-U web interface and is triggered by a specially crafted HTTP POST request containing a non-empty body and the header Content-Encoding: deflate. Multiple sources in the provided content state that the request body is passed into an in-memory deflate decompression path where faulty buffer management leads to an invalid free(), heap corruption, and termination of the Serv-U process. The vulnerable logic reportedly skips the intended rejection of deflate-encoded requests when HTTP compression is enabled, which is the default configuration, allowing unauthenticated remote attackers to reach the crashing code path pre-authentication.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository is a small, focused proof-of-concept for CVE-2026-28318 affecting SolarWinds Serv-U. It contains three files: an MIT LICENSE, a detailed README with root-cause analysis, and a single executable Python script `poc_verify.py`. The exploit is not part of a larger framework. The README explains that the issue is an unauthenticated network-reachable denial of service in the Serv-U HTTP/HTTPS listener, specifically in the `RhinoNET.dll` deflate handling path. According to the analysis, any HTTP request with `Content-Encoding: deflate` and a valid raw deflate body causes the server to free an interior pointer into the HTTP receive buffer rather than a heap allocation base, leading to heap corruption and a crash (`0xC0000374`, `STATUS_HEAP_CORRUPTION`). The write-up emphasizes that this is not a decompression bomb and that the crash is independent of decompressed size. The Python script operationalizes that analysis. It builds a highly compressible payload using Python's standard `zlib` library with raw deflate (`wbits=-zlib.MAX_WBITS`), then sends one or more crafted HTTP POST requests to the target host and port. The request is minimal and always targets `/`, with the critical header `Content-Encoding: deflate`. The body can be either a small stream that inflates to 4096 null bytes or, with `--big`, 8192 'A' bytes. The exploit capability is therefore a pre-authenticated remote service crash against vulnerable Serv-U web listeners. The script also includes verification logic tailored for Windows-hosted local or authorized testing. It uses PowerShell `Get-NetTCPConnection` to determine the PID listening on the chosen port before and after sending the payload, and optionally uses `Get-WinEvent` to count new Application log crash events matching Serv-U and `c0000374`. Success is reported when the PID changes, the listener disappears, or matching heap-corruption events appear. This makes the PoC more than a bare trigger: it is a practical crash-verification tool for patch validation. Overall, the repository's purpose is defensive validation of patch status and crash reproducibility for a known Serv-U vulnerability. It does not contain an RCE payload, persistence, lateral movement logic, or post-exploitation features. Its sole capability is reliable unauthenticated DoS against vulnerable Serv-U HTTP/HTTPS services, plus local verification of the resulting crash.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
93 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated denial-of-service vulnerability in the SolarWinds Serv-U web interface that can crash the service via a crafted POST request using the Content-Encoding: deflate header, leading to heap corruption and process termination.
An unauthenticated denial-of-service vulnerability in SolarWinds Serv-U where a POST request with a Content-Encoding: deflate header and a body triggers heap corruption via an invalid free, crashing the service. The analysis concludes the practical impact is availability-only DoS rather than remote code execution.
An unauthenticated denial-of-service vulnerability in SolarWinds Serv-U's web interface where a POST request with a Content-Encoding: deflate header and a body triggers heap corruption and crashes the service.
An uncontrolled resource consumption denial-of-service vulnerability in SolarWinds Serv-U that can be triggered remotely and unauthenticated via crafted HTTP POST requests using the Content-Encoding: deflate header, causing the service to crash.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.