Business logic: why an attacker refuses to maintain an FTP server
An uncertified DoS on a enterprise-environmental server is not an abstract “availability problem.” Here is what happens in practice:
Automated file exchanges between counterparties stand up. In the financial sector, delayed calculations are a direct loss. According to HelpNetSecurity, the DoS vulnerability in Serv-U can be used to distract SOC from parallel hidden activity. While the blue team is cleaning up the fallen service, the attacker works on another vector. Plus multiple crash and restart are given by intelligence: how quickly the monitoring works, whether there is an automatic restart, whether the configuration changes after the incident.
In terms of kill chain, CVE-2026-28318 Go to the Impact phase - Application or System Exploitation (T1499.004). But in real DoS campaigns works as providing an element: reconnaissance of the attack surface through vulnerability scanning (T1595.002, Reconnaissance) -> operation of the public application (T1190, Initial Access) through another vulnerability -> DoS as cover or pressure. CISA notes that the vector is fully automated (SSVC: automatable - yes), so that mass scanning and operation are trivial.
Anatomy of SolarWinds Serv-U DoS Vulnerability: From Header to Heapr corruption
According to Bishop Fox, the root cause CVE-2026-28318 - security check tied to the wrong condition. The Serv-U web server must reject requests with Content-Encoding: deflate, but the code that does it is executed only when HTTP compression is disabled. By default, the compression is enabled - check is passed, and the query body with the title deflate enters directly into the decompressor.
Next up the chain is as follows:
1. The decompressor receives the body of the request and begins processing
2. The buffer control error causes free()on interior pointer - a pointer that should not be released
3. Hardened system allocator detects heap corruption
4. Allocator causes an emergency completion of the entire Serv-U process
The body of the request is not required to be validate with compressed data - any non-empty content is enough. This is not a compression bomb in a classic sense (when a small archive is unpacked in gigabytes), but an error in the processing of the title, leading to damage to the heap and crash.
Interesting point: NVD and SolarWinds classify vulnerability as CWE-400 (Uncontrolled Resource Consumption). According to Bishop Fox, the actual mechanism is damage to the ambulance with an emergency completion. CWE-400 describes the exhaustion of resources, and here the process simply ceases to exist. For the penesser, the difference is significant: exhaust repowerion is detected by the growth of CPU/RAM to fall, and the crash from invalid free is not. The process disappears instantly.
The patch in 15.5.4 HF1 does not correct the decompressor itself. Instead, a universal filter is added: any request with the body and non-empty title Content-EncodingDeviated with code 415 Unsupported Media Type before processing the body. SolarWinds directly indicates that Content-Encoding “No service is required.” This filter is the key to the safe detection of vulnerable hosts.
CVSS-vector and place in MITRE ATT&CK
Mapping on MITRE ATT&CK:
• Exploit Public-Facting Application (T1190, Initial Access) - the operation of the public web interface Serv-U
• Application or System Exploitation (T1499.004, Impact) - application failure as the end result
• Vulnerability Scanning (T1595.002, Reconnaissance) - detection of vulnerable specimens
CISA SSVC solution: Attend (Patch in the normal cycle). Parameters: exploitation - active, automatable - yes, technical impact - partial. For comparison, CVE-202-352111 (RCE in the same Serv-U) received a solution Act (Patch immediately) with technical impact - total. The difference between the DoS and the full compromising server is reflected in the prioritization, but "Atend" with active operation is not a reason to postpone.
Fingerprinting vulnerable Serv-U: safe detection without crash
[Applicable: external pretest, all versions of Serv-U up to 15.5.4 inclusive]
On a real pentest, drop the production service to test the hypothesis is not an option. Bishop Fox has developed a method of safe detection based on the behavioral difference between patched and unpatept Serv-U.
Logic simple: patch in HF1 adds filter that rejects Any Title Content-Encoding, not only deflate. Send POST with a safe value Content-Encoding: identity (identity = "without conversion", the request does not affect the decompressor and does not cause crash), and look at the answer:
• Pattified server (15.5.4 HF1+): return 415 Unsupported Media Type
• Vulnerable server (up to 15.5.4): will process the request normally, the service will remain in operation
Bash:
curl -sk -X POST https://target:443/ -H "Content-Encoding: identity" -d "probe" -o /dev/null -w "HTTP %{http_code}\n"
The request never sends deflate, the decompressor is not called, crash will not. Bishop Fox has released a ready-made tool for mass verification - BishopFox/CVE-2026-28318-check on GitHub.
Disorders of fingerprinting: if between you and Serv-U is WAF or reverse proxy, self-processing Content-EncodingThe result can be false negative. Check the server headers and the banner that the answer comes from Serv-U, not from the intermediate node.
To search for instances Serv-U in scope - standard methods: nmap -sV on ports 443 (web interface), 21/22 (FTP/SFTP), Shodan/Censys for foreign intelligence.
Reproduction of deflate bomb attack in an isolated lab
Adjustments to the environment:
• OS: Windows Server 2016/2019/2022 or GNU/Linux (Serv-U supports both platforms)
• RAM: minimum 2 GB for VM with Serv-U
• SolarWinds Serv-U version 15.5.4 or below (triple version on the SolarWinds website)
• The Serv-U web interface is included (by default - yes, check in the settings)
• Insulated network, without access to production systems
The structure of the query that causes crash (use only in an authorized labe):
Code:
POST / HTTP/1.1
Host: target
Content-Encoding: deflate
Content-Length: 4
test
The body may be any non-empty contents - valid deflate data is not required. After sending, the Serv-U process will be completed in an emergency. In Windows logs - the event of completion of the process, in GNU / Linux - a similar record.
If the server is configured automatic reboot of the service, a second request after lifting again calls the crash. A single DoS turns into a steady denial of service. Public PoC is available in repository EaE0001/servu-cve-2026-28318-poc on GitHub - description root call and DoS-only exploit.
When the technique is NOT working:
• Serv-U 15.5.4 HF1 (build 15.5.4.125) and above - filter deflects request to decompressor
• WAF or reverse proxy intercepts and strips Content-Encoding: deflateto Serv-U
• HTTP compression is clearly disabled in the Serv-U settings - in this case, the regular check on deflate is triggered correctly, but it is an atypical configuration; by default, the compression is enabled
Interoperability limits: why Content-Encoding deflate exploit doesn't lead to RCE
The Heap corruption is the first step to the remote code execution. The attacker controls which piece of memory is released, the data next to it is a standard set for outpatient. Bishop Fox dug into three directions and proved that each rests with a dead end:
1. Controlled free() at an arbitrary address. It was possible to bypass the protective check of the allocator, but the query structure forces one of the key values to be the most address space of the process. The result: either nothing happens or crash without control. Targeting exploitation is not possible.
2. Substitution of the neighboring pile block. Classic-stepup after controlled free - but the same limitation: it is impossible to shift the calculation far beyond the basement memory.
3. Integer overflow in decompressor. The size counter is too small and overflows on big data. The defect is real, but the requested and copied dimensions are managed by the same broken counter - they are mistaken synchronously. Bottom line: query of the impossible amount of memory and crash, not a controlled record.
According to Bishop Fox: it is impossible to completely exclude the existence of the path to RCE, but all obvious routes are closed with the specifics of the bug itself. Vendor rating - DoS only - is confirmed by independent reverse engineering.
For the penesser, this means: CVE-2026-28318 - tool Impact, not initial access. Need a shell on the server - look for other vectors. The improperly patched Serv-U is highly vulnerable to the earlier CVE, which are lower.
Mitigation: SolarWinds Serv-U patch and locking on WAF
Checklist for transfer to the administrator:
1. Update Serv-U to 15.5.4 HF1 (build 15.5.4.125) or higher. All versions up to 15.5.4 inclusive are vulnerable. If it costs 15.5.4 - HF1 is placed on top.
2. If the patch is not possible right now - block on WAF or reverse proxy POST requests with header Content-Encodingto Serv-U. SolarWinds confirms that this functionality is not required by the service. Rule condition: POST + title availability Content-Encoding-> or 403.
3. Limit network access to the Serv-U web interface only with IP trusted. The web interface is not needed by external users - close from the perimeter.
4. Check all Serv-U instances in infrastructure, including internal ones. For mass inspection - BishopFox/CVE-2026-28318-check(Safety, not causing crash).
5. Configure the Serv-U process crash monitoring. Emergency completion without a regular shutdown is an indicator of an attempt to operate or an attack.
SolarWinds publishes ready-made WAF rules for the main vendors at the Trust Center - check for the availability of rules for your infrastructure.
An uncertified DoS on a enterprise-environmental server is not an abstract “availability problem.” Here is what happens in practice:
Automated file exchanges between counterparties stand up. In the financial sector, delayed calculations are a direct loss. According to HelpNetSecurity, the DoS vulnerability in Serv-U can be used to distract SOC from parallel hidden activity. While the blue team is cleaning up the fallen service, the attacker works on another vector. Plus multiple crash and restart are given by intelligence: how quickly the monitoring works, whether there is an automatic restart, whether the configuration changes after the incident.
In terms of kill chain, CVE-2026-28318 Go to the Impact phase - Application or System Exploitation (T1499.004). But in real DoS campaigns works as providing an element: reconnaissance of the attack surface through vulnerability scanning (T1595.002, Reconnaissance) -> operation of the public application (T1190, Initial Access) through another vulnerability -> DoS as cover or pressure. CISA notes that the vector is fully automated (SSVC: automatable - yes), so that mass scanning and operation are trivial.
Anatomy of SolarWinds Serv-U DoS Vulnerability: From Header to Heapr corruption
According to Bishop Fox, the root cause CVE-2026-28318 - security check tied to the wrong condition. The Serv-U web server must reject requests with Content-Encoding: deflate, but the code that does it is executed only when HTTP compression is disabled. By default, the compression is enabled - check is passed, and the query body with the title deflate enters directly into the decompressor.
Next up the chain is as follows:
1. The decompressor receives the body of the request and begins processing
2. The buffer control error causes free()on interior pointer - a pointer that should not be released
3. Hardened system allocator detects heap corruption
4. Allocator causes an emergency completion of the entire Serv-U process
The body of the request is not required to be validate with compressed data - any non-empty content is enough. This is not a compression bomb in a classic sense (when a small archive is unpacked in gigabytes), but an error in the processing of the title, leading to damage to the heap and crash.
Interesting point: NVD and SolarWinds classify vulnerability as CWE-400 (Uncontrolled Resource Consumption). According to Bishop Fox, the actual mechanism is damage to the ambulance with an emergency completion. CWE-400 describes the exhaustion of resources, and here the process simply ceases to exist. For the penesser, the difference is significant: exhaust repowerion is detected by the growth of CPU/RAM to fall, and the crash from invalid free is not. The process disappears instantly.
The patch in 15.5.4 HF1 does not correct the decompressor itself. Instead, a universal filter is added: any request with the body and non-empty title Content-EncodingDeviated with code 415 Unsupported Media Type before processing the body. SolarWinds directly indicates that Content-Encoding “No service is required.” This filter is the key to the safe detection of vulnerable hosts.
CVSS-vector and place in MITRE ATT&CK
Mapping on MITRE ATT&CK:
• Exploit Public-Facting Application (T1190, Initial Access) - the operation of the public web interface Serv-U
• Application or System Exploitation (T1499.004, Impact) - application failure as the end result
• Vulnerability Scanning (T1595.002, Reconnaissance) - detection of vulnerable specimens
CISA SSVC solution: Attend (Patch in the normal cycle). Parameters: exploitation - active, automatable - yes, technical impact - partial. For comparison, CVE-202-352111 (RCE in the same Serv-U) received a solution Act (Patch immediately) with technical impact - total. The difference between the DoS and the full compromising server is reflected in the prioritization, but "Atend" with active operation is not a reason to postpone.
Fingerprinting vulnerable Serv-U: safe detection without crash
[Applicable: external pretest, all versions of Serv-U up to 15.5.4 inclusive]
On a real pentest, drop the production service to test the hypothesis is not an option. Bishop Fox has developed a method of safe detection based on the behavioral difference between patched and unpatept Serv-U.
Logic simple: patch in HF1 adds filter that rejects Any Title Content-Encoding, not only deflate. Send POST with a safe value Content-Encoding: identity (identity = "without conversion", the request does not affect the decompressor and does not cause crash), and look at the answer:
• Pattified server (15.5.4 HF1+): return 415 Unsupported Media Type
• Vulnerable server (up to 15.5.4): will process the request normally, the service will remain in operation
Bash:
curl -sk -X POST https://target:443/ -H "Content-Encoding: identity" -d "probe" -o /dev/null -w "HTTP %{http_code}\n"
The request never sends deflate, the decompressor is not called, crash will not. Bishop Fox has released a ready-made tool for mass verification - BishopFox/CVE-2026-28318-check on GitHub.
Disorders of fingerprinting: if between you and Serv-U is WAF or reverse proxy, self-processing Content-EncodingThe result can be false negative. Check the server headers and the banner that the answer comes from Serv-U, not from the intermediate node.
To search for instances Serv-U in scope - standard methods: nmap -sV on ports 443 (web interface), 21/22 (FTP/SFTP), Shodan/Censys for foreign intelligence.
Reproduction of deflate bomb attack in an isolated lab
Adjustments to the environment:
• OS: Windows Server 2016/2019/2022 or GNU/Linux (Serv-U supports both platforms)
• RAM: minimum 2 GB for VM with Serv-U
• SolarWinds Serv-U version 15.5.4 or below (triple version on the SolarWinds website)
• The Serv-U web interface is included (by default - yes, check in the settings)
• Insulated network, without access to production systems
The structure of the query that causes crash (use only in an authorized labe):
Code:
POST / HTTP/1.1
Host: target
Content-Encoding: deflate
Content-Length: 4
test
The body may be any non-empty contents - valid deflate data is not required. After sending, the Serv-U process will be completed in an emergency. In Windows logs - the event of completion of the process, in GNU / Linux - a similar record.
If the server is configured automatic reboot of the service, a second request after lifting again calls the crash. A single DoS turns into a steady denial of service. Public PoC is available in repository EaE0001/servu-cve-2026-28318-poc on GitHub - description root call and DoS-only exploit.
When the technique is NOT working:
• Serv-U 15.5.4 HF1 (build 15.5.4.125) and above - filter deflects request to decompressor
• WAF or reverse proxy intercepts and strips Content-Encoding: deflateto Serv-U
• HTTP compression is clearly disabled in the Serv-U settings - in this case, the regular check on deflate is triggered correctly, but it is an atypical configuration; by default, the compression is enabled
Interoperability limits: why Content-Encoding deflate exploit doesn't lead to RCE
The Heap corruption is the first step to the remote code execution. The attacker controls which piece of memory is released, the data next to it is a standard set for outpatient. Bishop Fox dug into three directions and proved that each rests with a dead end:
1. Controlled free() at an arbitrary address. It was possible to bypass the protective check of the allocator, but the query structure forces one of the key values to be the most address space of the process. The result: either nothing happens or crash without control. Targeting exploitation is not possible.
2. Substitution of the neighboring pile block. Classic-stepup after controlled free - but the same limitation: it is impossible to shift the calculation far beyond the basement memory.
3. Integer overflow in decompressor. The size counter is too small and overflows on big data. The defect is real, but the requested and copied dimensions are managed by the same broken counter - they are mistaken synchronously. Bottom line: query of the impossible amount of memory and crash, not a controlled record.
According to Bishop Fox: it is impossible to completely exclude the existence of the path to RCE, but all obvious routes are closed with the specifics of the bug itself. Vendor rating - DoS only - is confirmed by independent reverse engineering.
For the penesser, this means: CVE-2026-28318 - tool Impact, not initial access. Need a shell on the server - look for other vectors. The improperly patched Serv-U is highly vulnerable to the earlier CVE, which are lower.
Mitigation: SolarWinds Serv-U patch and locking on WAF
Checklist for transfer to the administrator:
1. Update Serv-U to 15.5.4 HF1 (build 15.5.4.125) or higher. All versions up to 15.5.4 inclusive are vulnerable. If it costs 15.5.4 - HF1 is placed on top.
2. If the patch is not possible right now - block on WAF or reverse proxy POST requests with header Content-Encodingto Serv-U. SolarWinds confirms that this functionality is not required by the service. Rule condition: POST + title availability Content-Encoding-> or 403.
3. Limit network access to the Serv-U web interface only with IP trusted. The web interface is not needed by external users - close from the perimeter.
4. Check all Serv-U instances in infrastructure, including internal ones. For mass inspection - BishopFox/CVE-2026-28318-check(Safety, not causing crash).
5. Configure the Serv-U process crash monitoring. Emergency completion without a regular shutdown is an indicator of an attempt to operate or an attack.
SolarWinds publishes ready-made WAF rules for the main vendors at the Trust Center - check for the availability of rules for your infrastructure.
