Loading vulnerability…
CVE-2026-28318 is an unauthenticated denial-of-service vulnerability in SolarWinds Serv-U 15.5.4 and earlier. Serv-U's web-interface HTTP request handling can process a POST request carrying a non-empty body and a Content-Encoding value of deflate before authentication. Under the default HTTP-compression configuration, a conditional rejection check is bypassed and the body reaches an in-memory decompression path. Faulty buffer management in that path causes an invalid free and heap-corruption detection terminates the Serv-U process. SolarWinds addressed the issue in Serv-U 15.5.4 Hotfix 1 by rejecting requests with a body and a non-empty Content-Encoding header before body processing.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository is a small, focused proof-of-concept for CVE-2026-28318 affecting SolarWinds Serv-U. It contains three files: an MIT LICENSE, a detailed README with root-cause analysis, and a single executable Python script `poc_verify.py`. The exploit is not part of a larger framework. The README explains that the issue is an unauthenticated network-reachable denial of service in the Serv-U HTTP/HTTPS listener, specifically in the `RhinoNET.dll` deflate handling path. According to the analysis, any HTTP request with `Content-Encoding: deflate` and a valid raw deflate body causes the server to free an interior pointer into the HTTP receive buffer rather than a heap allocation base, leading to heap corruption and a crash (`0xC0000374`, `STATUS_HEAP_CORRUPTION`). The write-up emphasizes that this is not a decompression bomb and that the crash is independent of decompressed size. The Python script operationalizes that analysis. It builds a highly compressible payload using Python's standard `zlib` library with raw deflate (`wbits=-zlib.MAX_WBITS`), then sends one or more crafted HTTP POST requests to the target host and port. The request is minimal and always targets `/`, with the critical header `Content-Encoding: deflate`. The body can be either a small stream that inflates to 4096 null bytes or, with `--big`, 8192 'A' bytes. The exploit capability is therefore a pre-authenticated remote service crash against vulnerable Serv-U web listeners. The script also includes verification logic tailored for Windows-hosted local or authorized testing. It uses PowerShell `Get-NetTCPConnection` to determine the PID listening on the chosen port before and after sending the payload, and optionally uses `Get-WinEvent` to count new Application log crash events matching Serv-U and `c0000374`. Success is reported when the PID changes, the listener disappears, or matching heap-corruption events appear. This makes the PoC more than a bare trigger: it is a practical crash-verification tool for patch validation. Overall, the repository's purpose is defensive validation of patch status and crash reproducibility for a known Serv-U vulnerability. It does not contain an RCE payload, persistence, lateral movement logic, or post-exploitation features. Its sole capability is reliable unauthenticated DoS against vulnerable Serv-U HTTP/HTTPS services, plus local verification of the resulting crash.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
94 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A separate SolarWinds Web Help Desk vulnerability referenced only as having been added to CISA's Known Exploited Vulnerabilities catalog.
An unauthenticated denial-of-service vulnerability in the SolarWinds Serv-U web interface that can crash the service via a crafted POST request using the Content-Encoding: deflate header, leading to heap corruption and process termination.
An unauthenticated denial-of-service vulnerability in SolarWinds Serv-U where a POST request with a Content-Encoding: deflate header and a body triggers heap corruption via an invalid free, crashing the service. The analysis concludes the practical impact is availability-only DoS rather than remote code execution.
An unauthenticated denial-of-service vulnerability in SolarWinds Serv-U's web interface where a POST request with a Content-Encoding: deflate header and a body triggers heap corruption and crashes the service.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.