Provenance Record

Clear, well-structured News piece (580 words) with standard Overview / What We Know / What We Don't Know / Analysis sections and appropriate technical depth on the CVSS vector and exploitation mechanism. Neutral, restrained tone with no sensationalism.

Read both gzipped snapshots from disk and confirmed each uncompressed sha256 matches manifest.json. source-0.html.gz (NVD, status 200) confirms: CVE-2026-28318; description verbatim ('SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate'); CVSS 3.1 base 7.5 HIGH with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CNA: SolarWinds); CWE-400 Uncontrolled Resource Consumption; Published 06/04/2026; affected CPE range 'up to (excluding) 15.5.4' plus '15.5.4:-' base release; KEV/BOD-22-01 references present. source-1.html.gz (SecurityWeek, status 200, by Ionut Arghire) confirms verbatim: the KEV-catalog sentence, 'prevents attackers from crashing the Serv-U service via requests containing the Content-Encoding: deflate header and some data', the BOD 22-01 / June 19 sentence, the 'unclear who is behind the attacks...zero-day' sentence, and the affected builds 15.4.2 / 15.5 / 15.5.1 (EoL). Bot-blocked CISA KEV and SolarWinds advisory (403) are correctly NOT cited; no discoverer name was invented (source explicitly does not credit one).

All specifics verbatim-sourced EXCEPT the patch timeline. The body claims 'SolarWinds released a fix the day after the KEV listing', 'the hotfix shipped on June 6, 2026', and 'barely two days between the June 4 NVD publication and the June 6 hotfix'. SecurityWeek instead says the flaw 'had been patched a couple of days earlier' than the June 5 (Friday) KEV listing and SolarWinds 'warned on Thursday' (June 4) — i.e. the patch PREDATES the KEV listing. 'June 6, 2026' appears in neither source and is fabricated. This is the sole error; it is recoverable via a corrections note since the lead facts hold.

APPROVE_WITH_CORRECTIONS. Strong, well-sourced reporting with a single recoverable timeline error (a fabricated June 6 hotfix date and an inverted patch/KEV order) that is not in the headline and is honestly summarizable in a public corrections record. Publishing with the correction is the right outcome under v3.9.0.