CVE-2026-9190 HTTP request smuggling in Progress MarkLogic Server
Remote attackers can bypass authentication and hijack sessions in MarkLogic Server via HTTP request smuggling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9190?
CVE-2026-9190 is a critical vulnerability in Progress Software Corporation MarkLogic Server, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently.
Weakness: CWE-444
Which versions are affected by CVE-2026-9190?
It affects 1 product.
Products include Progress Marklogic Server.
How do I fix CVE-2026-9190?
No fix has been published for CVE-2026-9190 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-9190 being exploited?
There is no known exploitation of CVE-2026-9190 in the wild and no public exploit code.
Other vulnerabilities in Progress Software Corporation MarkLogic Server
- CVE-2026-7329 Privilege escalation in Progress MarkLogic Server REST query interfaces
- CVE-2026-8709 Privilege escalation in Progress MarkLogic Server REST document patch operation
- CVE-2026-9193 Privilege escalation in Progress MarkLogic Server Hadoop integration
- CVE-2026-9192 Authentication bypass in Progress MarkLogic Server ODBC App Server
- CVE-2026-9195 Cross-site scripting in Progress MarkLogic Server Query Console
Sources
Also known as GHSA-984c-qj5w-fv7j.