CLEANSTART-2026-LC56406 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33)

🗓️ 23 Oct 2026 00:37:10Reported by GoogleType

osv_cleanstart🔗 osv.dev

HTTP Request Smuggling in Elasticsearch in the sonarqube package leads to information disclosure.

Reporter	Title	Published	Views	Family All 33
CVE	CVE-2026-78605	1 Sep 202619:20	–	cve
Cvelist	CVE-2026-78605 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure	1 Sep 202619:20	–	cvelist
Elastic	Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-141)	1 Sep 202618:46	–	elastic
Tenable Nessus	Elasticsearch 8.18.x < 8.19.20 / 9.0.x < 9.4.5 / 9.5.x < 9.5.1 Information Disclosure (ESA-2026-141)	9 Sep 202600:00	–	nessus
EUVD	EUVD-2026-69568	1 Sep 202619:20	–	euvd
Mend	CVE-2026-78605	1 Sep 202619:20	–	mend
NVD	CVE-2026-78605	1 Sep 202620:17	–	nvd
osv_bit	BIT-ELASTICSEARCH-2026-78605 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure	3 Sep 202608:40	–	osv_bit
osv_cleanstart	CLEANSTART-2026-XT16211 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33)	6 Oct 202600:39	–	osv_cleanstart
osv_mini	MINI-2HXW-PJ7Q-WR3M	3 Sep 202615:43	–	osv_mini

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LC56406.json
osv	www.osv.dev/vulnerability/CVE-2026-78605
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-78605

23 Oct 2026 00:45Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.9

EPSS0.00338

sonarqube Elasticsearch HTTP Request Smuggling information disclosure