---
id: 6159
title: "CVE-2026-28318 — SolarWinds Serv-U HTTP Deflate Uncontrolled Resource Consumption"
cve: CVE-2026-28318
source_domain: aretiq.ai
source_url: "https://aretiq.ai/research/vul260607-cve-2026-28318-solarwinds-serv-u-http-deflate-uncontrolled-resource-consumption/"
published_at: "2026-06-07T00:00:00Z"
tags: ["rce", "vulnerability", "cve", "solarwinds", "dos", "serv-u", "cve-2026-28318", "kev", "decompression-bomb", "aretiq-ai"]
phying_url: "https://phying.com/item/6159"
lang: en
---

# CVE-2026-28318 — SolarWinds Serv-U HTTP Deflate Uncontrolled Resource Consumption

## Summary

SolarWinds Serv-U's HTTP deflate handler decompresses small POST bodies into gigabytes of memory, crashing the service without authentication. Fixed in 15.5.4 Hotfix 1 and listed in CISA's KEV.

## Intelligence Metadata

- **Sources:** aretiq.ai
- **CVE:** CVE-2026-28318
- **Published:** 2026-06-07T00:00:00Z
- **Original:** https://aretiq.ai/research/vul260607-cve-2026-28318-solarwinds-serv-u-http-deflate-uncontrolled-resource-consumption/
- **Phying News:** https://phying.com/item/6159