CVE-2026-9190 in MarkLogic Server
Summary
by MITRE • 08/05/2026
An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability represents a critical HTTP request smuggling flaw in Progress MarkLogic Server affecting versions prior to 11.3.6 and 12.0.3, which directly violates the fundamental principles of web application security and authentication mechanisms. The flaw stems from improper handling of conflicting HTTP headers where both Content-Length and Transfer-Encoding are present in a single request, creating a divergence in how different components interpret the request boundaries. This condition falls under CWE-444, specifically addressing improper handling of HTTP requests with conflicting headers, and aligns with ATT&CK technique T1566.001 for initial access through malicious web content.
The technical implementation of this vulnerability exploits the inconsistent behavior between a reverse proxy and the MarkLogic Server when processing HTTP requests containing both Content-Length and Transfer-Encoding headers simultaneously. When these headers are present together, they create ambiguity in request boundary determination where the reverse proxy may interpret one header while the MarkLogic server interprets another, leading to a situation where portions of the malicious request can be processed by one component while other portions are handled by the other. This mismatch allows attackers to inject malicious content or manipulate request routing, effectively creating a tunnel for unauthorized access.
The operational impact of this vulnerability extends far beyond simple authentication bypass as it enables sophisticated attack vectors including session hijacking, credential theft, and privilege escalation within the MarkLogic environment. Attackers can leverage this flaw to impersonate legitimate users, access restricted resources, and potentially escalate privileges through the compromised sessions. The vulnerability's remote nature means attackers do not require physical access or network proximity, making it particularly dangerous in enterprise environments where MarkLogic servers often serve as backend systems for critical applications.
Organizations utilizing affected MarkLogic Server versions face significant risk of data breaches and unauthorized system access when this vulnerability remains unpatched. The authentication bypass capability directly violates security principles established in standards such as NIST SP 800-53 and ISO/IEC 27001, particularly those addressing access control and session management. The session hijacking aspect creates persistent threats where attackers can maintain long-term access to systems while remaining undetected, making this vulnerability particularly dangerous for environments handling sensitive or regulated data.
Mitigation strategies should prioritize immediate patching of affected systems to version 11.3.6 or 12.0.3 where the vulnerability has been addressed through proper header validation and request boundary handling. Network-level protections including web application firewalls can provide temporary defense by monitoring for suspicious header combinations, though these solutions are not foolproof against sophisticated attacks. Organizations should also implement strict HTTP header validation policies within their reverse proxy configurations to prevent the propagation of conflicting headers to backend MarkLogic servers. Additionally, security teams must monitor for anomalous authentication patterns and session behavior that might indicate exploitation attempts, while ensuring proper logging and audit trails are maintained for forensic analysis purposes.