CVE-2026-9190

Katalog CVE

CVSS 9.1 · Critical EPSS 0,74%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada progress marklogic server. Skor CVSS 3.1 9.1 (Critical) menurut progress.com.

Deskripsi (NVD)

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently.

Rincian

Terbit di NVD

5 Agustus 2026

Terakhir diubah

3 September 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber progress.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026 advisory vendor