Security Event Manager
CVE-2022-38114: Client-Side Desync Vulnerability
This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityMEDIUMCVSS 3.1 6.1
EPSS0.55%Chance of exploitation in 30 days
Public exploitNot tracked
FixAvailable
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| SolarWinds SEM 2022.2 and previous versions | 2022.4 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.