Critical severity9.1NVD Advisory· Published Aug 5, 2026· Updated Oct 23, 2026
CVE-2026-9190
CVE-2026-9190
Description
An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently.
Affected products
2cpe:2.3:a:progress:marklogic_server:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:progress:marklogic_server:*:*:*:*:*:*:*:*range: <11.3.6
- (no CPE)range: <11.3.6, <12.0.3
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.