SolarWinds Serv-U is vulnerable to specially crafted POST requests that crash the service, leading to an unauthenticated denial of service. The issue is triggered when the request includes the header Content-Encoding: deflate, which the application processes without proper validation, resulting in a service outage for users relying on Serv‑U.

The vulnerability affects SolarWinds Serv-U; the advisory specifies that Serv‑U 15.5.4 Hotfix 1 contains the fix, so any installation that has not applied this hotfix or a later update is potentially impacted. No other product variants are listed.

The CVSS score of 7.5 indicates high severity, while no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely over the network by sending a crafted POST request with the deflate header, and authentication is not required, making the attack straightforward.