CVE-2009-1903: Fedoraproject Fedora

Medium severity, CVSS 4.3. EPSS: 3% chance of exploitation in the next 30 days.

The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF file that does not use the GET method.

Affected products

• Fedoraproject Fedora: version 9 only; version 10 only
• Trustwave Modsecurity: before 2.5.8 (fixed in 2.5.8)

Published 2009-06-03. Last modified 2026-06-16.