CVE-2026-28318

CVE-2026-28318 is a pre-authentication denial-of-service vulnerability in SolarWinds Serv-U affecting the HTTP parsing component. An unauthenticated attacker can crash the service by sending a POST request with a malformed Content-Encoding: deflate header. CISA has confirmed active exploitation — this is not theoretical. The CVSS 7.5 score invites complacency, but consider the operational context: Serv-U is enterprise file transfer infrastructure. When it goes down, automated B2B exchanges stall, supply chain integrations fail, and privileged administrative file movement halts. On Windows deployments, a crash loop may require console-level access to recover — potentially unreachable in incident response scenarios. The deflate compression vector is the notable detail. This likely isn't a classic buffer overflow — modern compiler mitigations would often catch that. The more probable mechanism is algorithmic complexity: certain malformed deflate streams trigger pathological behavior in zlib inflate, causing exponential decompression time or memory expansion that exhausts process resources and crashes the service. This changes your detection strategy. Instead of looking only for crash events, monitor for sustained CPU or memory spikes on Serv-U HTTP handler threads. For immediate containment without patching, apply header-based filtering at your perimeter firewall or load balancer: rate-limit or block HTTP requests to Serv-U's HTTP port (typically 9080) containing Content-Encoding: deflate. This neutralizes the attack surface while preserving SFTP and FTPS workflows — you don't need to disable the entire service. Verify whether your SIEM or network telemetry can detect HTTP 500 responses originating from Serv-U endpoints, which would indicate active exploitation attempts. The 0.08351 EPSS score (8% probability of exploitation in 30 days) should not drive prioritization here — KEV status and confirmed active exploitation already establish the urgency. Patch immediately. If patching is delayed, the targeted header filter is your highest-signal mitigation; avoid the blunt approach of disabling the HTTP frontend entirely unless you've mapped downstream dependencies.

Reviewed through automated stages and approved by a human before publication.