CVE-2026-9190

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3

Description An HTTP request smuggling issue exists in the HTTP App Server. This occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and the server to interpret request boundaries differently. A remote attacker can exploit this to bypass authentication and authorization checks, hijack legitimate user sessions, or capture credentials.

Recommendations Update Progress MarkLogic Server to version 11.3.6 or later. Update Progress MarkLogic Server to version 12.0.3 or later.