Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2019-17567

Medium

Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP…

Published Jun 11, 2021 · Updated Sep 10, 2026 · Also known as DEBIAN-CVE-2019-17567, DLA-3818-1, TR-21-0470, UBUNTU-CVE-2019-17567

Key Facts

Patch immediately
  • CVE-2019-17567 is a medium-severity vulnerability (CVSS 5.3 v3.1) affecting HTTP Server (Apache), Enterprise Manager Ops Center (Oracle), Instantis Enterprisetrack (Oracle) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 60% probability of exploitation in the next 30 days.
  • Fixed versions are available, including apache 2.4.47-1, HTTP Server <=2.4.46, apache2 2.4.48-2.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS (30-day exploit likelihood)

60%

Higher than 99.1% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2019-17567 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.

Affected Products

78 affected entries in total
ProductAffected versionsFixed in
HTTP ServerApache>= 2.4.462.4.46
Enterprise Manager Ops CenterOracle12.4.0.0n/a
Instantis EnterprisetrackOracle17.1, 17.2, 17.3n/a
Zfs Storage Appliance KitOracle8.8n/a
FedoraFedoraproject34, 35n/a
20 more affected products in the full CVE brief

Patched Releases

apache

2.4.47-1

HTTP Server

<=2.4.46

apache2

2.4.48-2, 2.4.59-1~deb10u1

httpd

2.4.48-1.ph1, 2.4.48-1.ph2, 2.4.48-1.ph3, 2.4.48-2.amzn2, 2.4.49-1, 2.4.52-1

httpd-devel

2.4.48-2.amzn2

httpd-filesystem

2.4.48-2.amzn2

httpd-manual

2.4.48-2.amzn2

httpd-tools

2.4.48-2.amzn2

httpd24

2.4.48-1.92.amzn1

httpd24-devel

2.4.48-1.92.amzn1

httpd24-manual

2.4.48-1.92.amzn1

httpd24-tools

2.4.48-1.92.amzn1

jbcs-httpd24-apr

0:1.6.3-107.el8jbcs, 0:1.6.3-107.jbcs.el7

jbcs-httpd24-apr-util

0:1.6.1-84.el8jbcs, 0:1.6.1-84.jbcs.el7

jbcs-httpd24-curl

0:7.78.0-2.el8jbcs, 0:7.78.0-2.jbcs.el7

jbcs-httpd24-httpd

0:2.4.37-78.el8jbcs, 0:2.4.37-78.jbcs.el7

jbcs-httpd24-mod_cluster-native

0:1.3.16-9.Final_redhat_2.el8jbcs, 0:1.3.16-9.Final_redhat_2.jbcs.el7

jbcs-httpd24-mod_http2

0:1.15.7-21.el8jbcs, 0:1.15.7-21.jbcs.el7

jbcs-httpd24-mod_jk

0:1.2.48-20.redhat_1.el8jbcs, 0:1.2.48-20.redhat_1.jbcs.el7

jbcs-httpd24-mod_md

1:2.0.8-40.el8jbcs, 1:2.0.8-40.jbcs.el7

jbcs-httpd24-mod_security

0:2.9.2-67.GA.el8jbcs, 0:2.9.2-67.GA.jbcs.el7

jbcs-httpd24-nghttp2

0:1.39.2-39.el8jbcs, 0:1.39.2-39.jbcs.el7

jbcs-httpd24-openssl

1:1.1.1g-8.el8jbcs, 1:1.1.1g-8.jbcs.el7

jbcs-httpd24-openssl-chil

0:1.0.0-7.el8jbcs, 0:1.0.0-7.jbcs.el7

jbcs-httpd24-openssl-pkcs11

0:0.4.10-22.el8jbcs, 0:0.4.10-22.jbcs.el7

Timeline

  1. Publicly disclosed

    Jun 11, 2021

  2. Last updated

    Sep 10, 2026

Weakness Type

  • CWE-287 Improper Authentication
  • CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2019-17567 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo