Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.
Affected Versions:
- 8.x: All versions from 8.18.0 up to and including 8.19.19
- 9.x:
- All versions from 9.0.0 up to and including 9.4.4
- Version 9.5.0
Affected Configurations:
The underlying defect is present in all Elasticsearch deployments running an affected version that expose an HTTP/1.1 listener. Successful cross-user response disclosure additionally requires an intermediate proxy or load balancer that shares and reuses persistent backend connections across independent client sessions.
Solutions and Mitigations:
The issue is resolved in Elasticsearch versions 8.19.20, 9.4.5, and 9.5.1.
For Users that Cannot Upgrade:
Self-Managed
Configure any intermediate proxy or load balancer not to reuse backend connections across independent client sessions. This prevents the cross-user response disclosure, but does not remediate the underlying HTTP framing defect in Elasticsearch itself.
Cloud
There are no workarounds for Elastic Cloud Hosted deployments. Users should upgrade to a fixed version.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 5.9 ) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID: CVE-2026-78605
Problem Type: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Impact: CAPEC-33 - HTTP Request Smuggling