Apache APISIX versions 3.18.0 through 3.19.0 contain an interpretation conflict vulnerability that leads to incorrect authorization. When the match_uri_encoded_slash option is enabled along with skip_mtls_uri_regex configuration, a client without a certificate can access upstream services behind routes that require client certificates, but only for request paths that decode to an exempted URI. This issue is resolved in version 3.20.0.