EUVD-2026-53426
GHSA-984c-qj5w-fv7j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network, unauthenticated (PR:N) with no UI, but AC:H because it needs a fronting proxy whose parsing diverges from MarkLogic; high confidentiality/integrity from session/credential theft, no availability impact.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently.
AnalysisAI
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote attacker desynchronize request parsing between a fronting reverse proxy and MarkLogic, enabling authentication/authorization bypass, session hijacking, and credential capture. The flaw is exploitable over the network without authentication (PR:N) and carries a critical 9.1 CVSS with high confidentiality and integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the MarkLogic HTTP App Server to be deployed behind a reverse proxy or load balancer whose HTTP request parsing differs from MarkLogic's, and the attacker must be able to send a crafted HTTP/1.1 request containing both a Content-Length and a Transfer-Encoding header to that front-end. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1) indicates a network-reachable, unauthenticated, high-impact issue, and the impact set (auth bypass, session hijack, credential theft) is severe. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a single HTTP request to the MarkLogic HTTP App Server through its reverse proxy containing conflicting Content-Length and Transfer-Encoding headers, so the proxy forwards what it sees as one request while MarkLogic parses a hidden second request smuggled in the body. The smuggled prefix is prepended to the next legitimate user's request on the reused back-end connection, letting the attacker capture that user's credentials or session token or reach authenticated endpoints without valid credentials. … |
| Remediation | Vendor-released patch: upgrade to MarkLogic Server 11.3.6 or later on the 11.x line, or 12.0.3 or later on the 12.x line, per the Progress August 2026 Critical Security Alert (https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all MarkLogic Server instances and identify those running versions before 11.3.6 (for 11.x branch) or 12.0.3 (for 12.x branch), and assess network exposure to untrusted clients. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Marklogic Server
View allPrivilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a l
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthentic
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote at
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged u
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user h
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote, unauthenticated attacker to trigge
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today