CVE-2026-28318 — SolarWinds Serv-U HTTP Deflate Uncontrolled Resource Consumption

Sun, 07 Jun 2026 00:00:00 +0000

1. Overview

A vulnerability exists in SolarWinds Serv-U’s HTTP request handler that processes Content-Encoding: deflate encoded POST bodies. The server decompresses incoming deflate-encoded payloads without enforcing any limit on the decompressed size, allowing an attacker to send a small (~260KB) compressed payload that expands to hundreds of megabytes or gigabytes in memory. This uncontrolled memory allocation causes the Serv-U process to crash with SIGABRT, resulting in a complete denial of service. The attack requires no authentication and can be performed by any network-accessible client. SolarWinds addressed this vulnerability in Serv-U 15.5.4 Hotfix 1, released June 4, 2026. CISA added this CVE to the Known Exploited Vulnerabilities catalog on June 5, 2026, citing active exploitation in the wild.

Cve-2026-28318 on Aretiq AI

CVE-2026-28318 — SolarWinds Serv-U HTTP Deflate Uncontrolled Resource Consumption

1. Overview