An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authenti…

CVE-2026-9190 describes a critical HTTP request smuggling vulnerability in the HTTP App Server component of Progress MarkLogic Server. Affected versions include all releases prior to 11.3.6 and 12.0.3. The vulnerability is triggered by crafted HTTP requests containing both Content-Length and Transfer-Encoding headers, causing desynchronization between a reverse proxy and MarkLogic Server in interpreting request boundaries. A remote unauthenticated attacker can exploit this to bypass authentication and authorization controls, hijack legitimate user sessions, or capture user credentials. The vulnerability poses a significant risk to organizations using MarkLogic as a backend data platform behind a reverse proxy. Progress has issued a critical security alert and patches are available in versions 11.3.6 and 12.0.3. Organizations are advised to upgrade immediately to mitigate exposure.