Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure (CVE-2026-78605)

CVE-2026-78605 describes an HTTP Request Smuggling vulnerability in Elasticsearch where inconsistent parsing of HTTP requests between proxies and the server can be exploited. This flaw allows a network attacker, under specific proxy deployment configurations, to obtain confidential information by causing the server to send responses meant for other authenticated users. The vulnerability is identified as CWE-444 and is related to CAPEC-33 attack patterns. It affects Elasticsearch versions >=8.18.0 <8.19.20, >=9.0.0 <9.4.5, and >=9.5.0 <9.5.1. There are no known exploits in the wild, and the vulnerability is rated medium severity.

An attacker with network access and the ability to position themselves in the path of HTTP requests can exploit this vulnerability to disclose confidential information intended for other authenticated users. This could lead to unauthorized data exposure in affected Elasticsearch deployments configured with certain proxy setups.

A patch is available for this vulnerability. Users should upgrade Elasticsearch to a fixed version beyond the affected ranges. Since this is not a cloud service, remediation requires applying the vendor-provided fix. No additional mitigation guidance is provided or required beyond applying the official patch.