CVE-2026-78605mediumCWE-444

CVE-2026-78605: medium-severity vulnerability in Elasticsearch

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure

Published

Follow this CVE+ Monitor Elasticsearch

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.3%
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Elastic · Elasticsearch
Related CVEs — Elasticsearch

In the same product, most dangerous first.

CVE-2021-22145—CVE-2021-22145EPSS 76.2%CVE-2023-31419MEDIUMElasticsearch StackOverflow vulnerabilityEPSS 61.1%CVE-2019-7619—CVE-2019-7619EPSS 2.4%CVE-2019-7611—CVE-2019-7611EPSS 2.1%CVE-2023-31418HIGHElasticsearch uncontrolled resource consumptionEPSS 2.1%CVE-2018-3831—CVE-2018-3831EPSS 2.0%