--- title: A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318 description: CVE-2026-28318 lets an unauthenticated attacker crash SolarWinds Serv-U 15.5.4 and earlier with a single POST request carrying a Content-Encoding: deflate... canonical: https://daily.dev/posts/a-crash-not-a-shell-solarwinds-serv-u-cve-2026-28318-dnuxcjo11 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318 | daily.dev og:description: CVE-2026-28318 lets an unauthenticated attacker crash SolarWinds Serv-U 15.5.4 and earlier with a single POST request carrying a Content-Encoding: deflate... og:url: https://daily.dev/posts/a-crash-not-a-shell-solarwinds-serv-u-cve-2026-28318-dnuxcjo11 og:image: https://api.daily.dev/og/posts/DNUXCJo11.png og:image:alt: A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318 **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 6 min read · 0 upvotes · 0 comments ## Summary CVE-2026-28318 lets an unauthenticated attacker crash SolarWinds Serv-U 15.5.4 and earlier with a single POST request carrying a Content-Encoding: deflate header, triggering an invalid free() in the decompressor that the allocator catches by aborting the process. Bishop Fox reverse engineered the bug, confirmed real heap corruption underlies the crash, and attempted three separate exploitation paths toward remote code execution — all three were dead ends due to quirks in the bug's arithmetic. The confirmed impact matches SolarWinds' own CVSS 7.5 rating: availability-only denial of service, not RCE. The fix, Serv-U 15.5.4 HF1, rejects any request with a body and a non-empty Content-Encoding header rather than patching the decompressor itself, which also enables safe remote detection (a patched server returns 415 to a harmless encoding like identity, while a vulnerable one processes it normally). Bishop Fox released a safe detection tool on GitHub, and recommends patching, WAF filtering of Content-Encoding on POST requests, and restricting the web interface to trusted networks as mitigations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-28318 in SolarWinds Serv-U and how do I fix it? CVE-2026-28318 is an unauthenticated denial-of-service vulnerability in SolarWinds Serv-U 15.5.4 and earlier, rated CVSS 7.5. A single POST request with a Content-Encoding: deflate header and any body crashes the service via an invalid free() in the decompressor. Fix by updating to Serv-U 15.5.4 HF1 (build 15.5.4.125) or later; if you cannot patch immediately, block POST requests carrying a Content-Encoding header at your WAF. _Track vulnerability advisories like this one on daily.dev to patch internet-facing services before attackers move._ ### Can the SolarWinds Serv-U deflate crash bug be escalated to remote code execution? No, based on tested analysis it remains an availability-only denial of service despite genuine underlying heap corruption. Three separate exploitation paths were attempted against a live server: steering the freed memory address, faking a neighboring memory block to corrupt allocator bookkeeping, and exploiting a separate integer overflow counting bug in the decompressor. Each attempt hit an impossibly large value that forced calculations outside valid memory, closing off a viable path to code execution. _Developers weighing real exploit risk versus vendor CVSS scores can follow deep-dive analyses like this on daily.dev._ ### How can I detect if my Serv-U server is vulnerable to CVE-2026-28318 without crashing it? Send a POST request with a body and a harmless Content-Encoding value such as identity: a patched Serv-U 15.5.4 HF1 server responds with 415 Unsupported Media Type, while a vulnerable server processes the request normally and stays up, because the patch adds a universal gate rejecting any non-empty Content-Encoding header rather than fixing the decompressor itself. A public safe detection tool implementing this check is available on GitHub. _Security teams sweeping fleets for exposure can find tooling and advisories like this via daily.dev._ ## Similar posts on daily.dev - [CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers](https://daily.dev/posts/cisa-hackers-now-exploit-solarwinds-serv-u-flaw-to-crash-servers-yw8vsu17o) · BleepingComputer · 0 upvotes · 0 comments - [Master Key Included: Detecting SolarWinds ARM CVE-2026-28326](https://daily.dev/posts/master-key-included-detecting-solarwinds-arm-cve-2026-28326-dpxxppcpz) · Sliver C2 Documentation · 0 upvotes · 0 comments - [Unbounded decompression of attacker-supplied compressed message bodies](https://daily.dev/posts/unbounded-decompression-of-attacker-supplied-compressed-message-bodies-t6ypckd13) · Spring · 2 upvotes · 0 comments - [Attackers exploit Cisco Unified CM flaw weeks after patch release](https://daily.dev/posts/attackers-exploit-cisco-unified-cm-flaw-weeks-after-patch-release-z9hsxlegr) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/a-crash-not-a-shell-solarwinds-serv-u-cve-2026-28318-dnuxcjo11) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318","url":"https://daily.dev/posts/a-crash-not-a-shell-solarwinds-serv-u-cve-2026-28318-dnuxcjo11","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-crash-not-a-shell-solarwinds-serv-u-cve-2026-28318-dnuxcjo11"},"datePublished":"2026-08-23T12:21:38.599Z","dateModified":"2026-08-23T12:39:33.400Z","description":"CVE-2026-28318 lets an unauthenticated attacker crash SolarWinds Serv-U 15.5.4 and earlier with a single POST request carrying a Content-Encoding: deflate...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/415e27e29566eea50c330c7c37441bcf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/415e27e29566eea50c330c7c37441bcf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-crash-not-a-shell-solarwinds-serv-u-cve-2026-28318-dnuxcjo11","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,vulnerability","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-crash-not-a-shell-solarwinds-serv-u-cve-2026-28318-dnuxcjo11#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-28318 in SolarWinds Serv-U and how do I fix it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-28318 is an unauthenticated denial-of-service vulnerability in SolarWinds Serv-U 15.5.4 and earlier, rated CVSS 7.5. A single POST request with a Content-Encoding: deflate header and any body crashes the service via an invalid free() in the decompressor. Fix by updating to Serv-U 15.5.4 HF1 (build 15.5.4.125) or later; if you cannot patch immediately, block POST requests carrying a Content-Encoding header at your WAF. Track vulnerability advisories like this one on daily.dev to patch internet-facing services before attackers move."}},{"@type":"Question","name":"Can the SolarWinds Serv-U deflate crash bug be escalated to remote code execution?","acceptedAnswer":{"@type":"Answer","text":"No, based on tested analysis it remains an availability-only denial of service despite genuine underlying heap corruption. Three separate exploitation paths were attempted against a live server: steering the freed memory address, faking a neighboring memory block to corrupt allocator bookkeeping, and exploiting a separate integer overflow counting bug in the decompressor. Each attempt hit an impossibly large value that forced calculations outside valid memory, closing off a viable path to code execution. Developers weighing real exploit risk versus vendor CVSS scores can follow deep-dive analyses like this on daily.dev."}},{"@type":"Question","name":"How can I detect if my Serv-U server is vulnerable to CVE-2026-28318 without crashing it?","acceptedAnswer":{"@type":"Answer","text":"Send a POST request with a body and a harmless Content-Encoding value such as identity: a patched Serv-U 15.5.4 HF1 server responds with 415 Unsupported Media Type, while a vulnerable server processes the request normally and stays up, because the patch adds a universal gate rejecting any non-empty Content-Encoding header rather than fixing the decompressor itself. A public safe detection tool implementing this check is available on GitHub. Security teams sweeping fleets for exposure can find tooling and advisories like this via daily.dev."}}]} ```