CVE-2026-78605: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elastic Elasticsearch

This vulnerability in Elasticsearch arises from inconsistent interpretation of HTTP requests between components, enabling HTTP Request Smuggling (CWE-444). When deployed behind specific proxy configurations, a network attacker could exploit this inconsistency to obtain confidential HTTP responses meant for other authenticated users, resulting in information disclosure. The CVSS 3.1 base score is 5.9, reflecting a network attack vector with high complexity and no privileges or user interaction required. There is no known exploit in the wild and no vendor-provided patch or remediation level at this time.

Successful exploitation allows an unauthenticated network attacker to disclose confidential information by tricking the server into delivering responses intended for other authenticated users. The vulnerability does not affect system integrity or availability but compromises confidentiality under specific proxy setups.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and harden proxy configurations to prevent HTTP request smuggling risks. Monitor vendor channels for updates and apply patches promptly once available.