CVE-2026-78605 — Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Discl…

CVE-2026-78605

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure PUBLISHED

Description (CNA)

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.

Affected (CNA)

Vendor / product	Versions
Elastic / Elasticsearch	affected 8.18.0 through 8.19.19; affected 9.0.0 through 9.4.4; affected 9.5.0

CWE

CWE-444

References

https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-141/390092

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.