The vulnerability is an HTTP request smuggling flaw that allows a remote attacker to craft an HTTP request containing both Content-Length and Transfer-Encoding headers. This causes the reverse proxy and MarkLogic Server to interpret request boundaries differently, enabling the attacker to bypass authentication and authorization checks, hijack legitimate user sessions, or capture credentials. The weakness is identified as CWE-444 and the CVSS score of 9.1 indicates severe risk.

MarkLogic Server from Progress Software Corporation, specifically versions prior to 11.3.6 and 12.0.3, are affected. No specific patch release is listed in the data provided, so environments running these versions remain vulnerable.

The vulnerability is remotely exploitable over HTTP. No EPSS score is available, but the high CVSS score and lack of mitigation in CISA KEV suggest the risk is significant. Attackers could send crafted requests from untrusted networks to gain unauthorized access to user sessions or credentials. Until an official patch is available, the only practical defense is network isolation or a properly configured reverse proxy that rejects requests containing both headers.