The vulnerability arises from inconsistent parsing of HTTP requests containing both Content-Length and Transfer-Encoding headers by the reverse proxy and MarkLogic Server, leading to HTTP request smuggling. This can enable attackers to bypass security checks, hijack sessions, or steal credentials remotely without authentication. The affected product is Progress Software Corporation's MarkLogic Server, specifically versions 11.0.0 and 12.0.0. The CVSS 3.1 base score is 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity.

Successful exploitation can lead to bypassing authentication and authorization mechanisms, session hijacking of legitimate users, and credential theft. This compromises the confidentiality and integrity of the affected system without impacting availability. The vulnerability is remotely exploitable without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Users should monitor Progress Software Corporation advisories for updates and apply patches promptly once available. Until then, consider deploying additional network-level protections such as strict HTTP header validation or reverse proxy configurations that mitigate HTTP request smuggling risks.