CVE-2026-9190 Progress Software Corporation CVE debrief

Who should care

Organizations using Progress MarkLogic Server, particularly those with exposed instances or sensitive data, should be aware of this critical vulnerability and take immediate action to patch or mitigate the risk. This includes reviewing current deployments, assessing potential impact, and prioritizing patching efforts for affected systems.

Technical summary

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently. This could lead to unauthorized access or session hijacking.

Defensive priority

Organizations using Progress MarkLogic Server should prioritize patching to prevent potential authentication and authorization bypasses.

Recommended defensive actions

• Apply patches or updates to Progress MarkLogic Server to version 11.3.6 or 12.0.3
• Review and update authentication and authorization configurations
• Monitor for suspicious HTTP requests
• Consider implementing additional security controls such as Web Application Firewalls
• Conduct thorough inventory checks to identify affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently. Evidence is based on official CVE and NVD records, as well as a security alert bulletin from Progress.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.