CVE-2019-17567

CVE-2019-17567 is a medium-severity vulnerability affecting Apache HTTP Server versions 2.4.6 to 2.4.46, specifically its mod_proxy_wstunnel module, as well as Fedora Project and Oracle products. It allows an attacker to bypass HTTP validation, authentication, and authorization by tunneling subsequent requests through an un-upgraded connection. The vulnerability has a CVSS score of 5.3 (Medium) with a low attack complexity and no user interaction required, potentially leading to information disclosure. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in the CISA KEV catalog, though it has received some community discussion and media coverage.