Servu Deflate Post Request Detection

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•2•0•4

This rule detects unauthenticated POST requests with 'Content-Encoding: deflate' in the HTTP header or command line, specifically targeting a vulnerability in SolarWinds Serv-U. The rule aims to identify exploitation attempts related to CVE-2026-28318.