SolarWinds Serv-U is vulnerable to specially crafted POST requests that crash the service, leading to an unauthenticated denial of service. The issue is triggered when the request includes the header Content-Encoding: deflate, which the application processes without proper validation, resulting in a service outage for users relying on Serv-U.

The vulnerability affects SolarWinds Serv-U; the advisory specifies that Serv-U 15.5.4 Hotfix 1 contains the fix, so any installation that has not applied this hotfix or a later update is potentially impacted. No other product variants are listed.

The CVSS score of 7.5 indicates high severity, while the EPSS score of 11% indicates an exploitation probability of roughly 11% and the vulnerability is listed in the CISA KEV catalog. An attacker can exploit the flaw remotely over the network by sending a crafted POST request with the deflate header, and authentication is not required, making the attack straightforward.