CVE-2026-78605

Awaiting Analysis Awaiting Analysis - Queue

HTTP Request Smuggling in Elasticsearch

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Elastic

Description

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-78605

EUVD

EUVD-2026-69568

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 8.18.0 (inc) to 8.19.19 (inc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.4.4 (inc)
elastic	elasticsearch	9.5.0
elastic	elasticsearch	8.19.20
elastic	elasticsearch	9.4.5
elastic	elasticsearch	9.5.1
elastic	elasticsearch	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

CVE-2026-78605 is an HTTP Request Smuggling vulnerability in Elasticsearch (CWE-444). It occurs when a proxy or load balancer misinterprets HTTP requests, allowing an attacker to smuggle malicious requests past security controls. This can lead to information disclosure if the attacker obtains confidential responses meant for other authenticated users.

Detection Guidance

Detecting HTTP Request Smuggling (CVE-2026-78605) requires monitoring network traffic for inconsistencies in HTTP request parsing between proxies and Elasticsearch. Use tools like Burp Suite, OWASP ZAP, or tcpdump to inspect HTTP requests and responses for anomalies such as mismatched content lengths or delayed responses. Check proxy logs for unusual patterns in connection reuse or session handling.

Impact Analysis

This vulnerability allows a network attacker to access sensitive data intended for other users if your Elasticsearch deployment uses a vulnerable proxy or load balancer configuration. It could expose confidential information like user sessions, personal data, or credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations must address this flaw to maintain compliance with these regulations.

Mitigation Strategies

Immediately upgrade Elasticsearch to versions 8.19.20, 9.4.5, or 9.5.1. If upgrading is not possible, configure intermediate proxies or load balancers to avoid reusing backend connections. For cloud-hosted deployments, upgrading is the only mitigation as workarounds are unavailable.

Hi! I’m here to help you understand CVE-2026-78605. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70