CVE-2026-9190 PUBLISHED

HTTP request smuggling in Progress MarkLogic Server

Assigner: ProgressSoftware
Reserved: 21.05.2026 Published: 05.08.2026 Updated: 05.08.2026

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 9.1

Product Status

Vendor Progress Software Corporation
Product MarkLogic Server
Versions Default: unaffected
  • affected from 11.0.0 to 11.3.6 (excl.)
  • affected from 12.0.0 to 12.0.3 (excl.)

Workarounds

Do not expose MarkLogic HTTP App Servers directly to untrusted networks. Configure a reverse proxy or web application firewall to reject requests that contain both Content-Length and Transfer-Encoding headers, and restrict access to trusted networks until the update can be applied.

References

Problem Types

  • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CWE

Impacts

  • HTTP Request Smuggling