# SolarWinds Serv-U DoS (CVE-2026-28318) — Actively Exploited Uncontrolled Resource Consumption via Content-Encoding: deflate POST

> CVE-2026-28318 is an unauthenticated denial-of-service vulnerability in SolarWinds Serv-U (FTP/MFT) below 15.5.4 HF1. An attacker sends an HTTP POST carrying a 'Content-Encoding: deflate' header, forcing the management web service to decompress attacker-controlled data without bounds, exhausting CPU/memory and crashing the service. CISA added it to the KEV catalog on 2026-06-05 amid confirmed in-the-wild exploitation, with a federal remediation deadline of 2026-06-19.

- **Published:** 2026-06-08T00:00:00Z
- **Last reviewed:** 2026-09-10T01:54:45.603Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0717
- **ID:** TL-2026-0717
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-28318

## Description

CVE-2026-28318 is an uncontrolled resource consumption (CWE-400) flaw in the SolarWinds Serv-U managed file transfer and FTP server. The Serv-U HTTP/HTTPS management and client interface accepts request bodies annotated with a 'Content-Encoding: deflate' header even on endpoints where compressed input is neither expected nor required. When such a request arrives, Serv-U inflates the supplied deflate stream into an in-memory buffer before any authentication or size validation occurs. Because the inflation routine does not enforce a decompressed-size ceiling or a compression-ratio limit, a small, highly compressible payload (a classic 'zip bomb' / 'deflate bomb' pattern) expands to hundreds of megabytes or gigabytes in memory. A handful of concurrent requests drive the worker process into sustained CPU saturation and memory exhaustion, causing the Serv-U service to become unresponsive or terminate. The attack requires no credentials and only network reachability to the listening management port (default 443/TCP, also 80/TCP), making any internet-exposed Serv-U instance trivially crashable.

The exploit primitive is a single, well-formed HTTP POST: the attacker compresses a long run of repeated bytes (for example a multi-megabyte string of null bytes or 'A' characters) with raw DEFLATE, sets 'Content-Encoding: deflate' and a small, plausible 'Content-Length', and posts it to any handled path. The decompression amplification ratio for such input commonly exceeds 1000:1, so a ~10 KB request body can force gigabyte-scale allocation. Reliability is high and the attack is repeatable; recovery requires a process or host restart. No code execution, data disclosure, or persistence results — impact is strictly availability (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Exploitation observed in the wild has been opportunistic and automated: mass scanning of Shodan/Shadowserver-indexed Serv-U hosts (~12,000 and ~3,100 exposed respectively) followed by repeated deflate-bomb POSTs to keep targets offline. Because the malicious request is structurally indistinguishable from a benign compressed upload except for the anomalous header on non-upload endpoints and the extreme decompression ratio, detection relies on request-header inspection, decompressed-size accounting at the proxy/WAF, and host telemetry for sudden Serv-U memory/CPU spikes and service crashes. SolarWinds remediated the issue in Serv-U 15.5.4 HF1 by rejecting unexpected Content-Encoding and bounding decompression.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Active Scanning: Vulnerability Scanning
- T1592.002 Gather Victim Host Information: Software
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1588.005 Obtain Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1499 Endpoint Denial of Service
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1499.002 Endpoint Denial of Service: Service Exhaustion Flood
- T1498 Network Denial of Service
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1595.001 Active Scanning: Scanning IP Blocks
- T1590.005 Gather Victim Network Information: IP Addresses
- T1596.005 Search Open Technical Databases: Scan Databases
- T1587.004 Develop Capabilities: Exploits

## Sources

- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers](https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-solarwinds-serv-u-flaw-to-crash-servers/)
- [SolarWinds Patches Exploited Serv-U Vulnerability](https://www.securityweek.com/solarwinds-patches-exploited-serv-u-vulnerability/)
- [CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)](https://www.helpnetsecurity.com/2026/06/08/cisa-patch-actively-exploited-solarwinds-serv-u-dos-vulnerability-cve-2026-28318/)
- [NVD — CVE-2026-28318](https://nvd.nist.gov/vuln/detail/CVE-2026-28318)
- [SolarWinds Serv-U Release Notes — 15.5.4 HF1](https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4_hotfix_1_release_notes.htm)
- [CWE-400: Uncontrolled Resource Consumption](https://cwe.mitre.org/data/definitions/400.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0717