Back Linuxsecurity

Fedora 37 clamav Medium DoS CVE-2026-20032 SUSE-2026-0910

Linuxsecurity •LinuxSecurity Advisories • March 17, 2026

This update for clamav fixes the following issues: Update to clamav 1.5.2: Security issue: * CVE-2026-20031: improper error handling in the HTML CSS module when splitting UTF-8 strings can lead to denial of service conditions via a crafted HTML file (bsc#1259207). Non security issue: * Support transactional updates (jsc#PED-14819). Changelog: * Fixed a possible infinite loop when scanning some JPEG files by upgrading affected ClamAV dependency, a Rust image library. * The CVD verification process will now ignore certificate files in the CVD certs directory when the user lacks read permissions. * Freshclam: Fix CLD verification bug with PrivateMirror option. * Upgraded the Rust bytes dependency to a newer version to resolve RUSTSEC-2026-0007 advisory. * Fixed a possible crash caused by invalid pointer alignment on some platforms. * Minimal required Rust version is now 1.87.

## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-906=1

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

zypper in -t patch SUSE-2026-906=1

* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * libclammspack0-1.5.2-150400.13.5.1 * clamav-debuginfo-1.5.2-150400.13.5.1 * libclamav12-debuginfo-1.5.2-150400.13.5.1 * libfreshclam4-debuginfo-1.5.2-150400.13.5.1 * clamav-milter-1.5.2-150400.13.5.1 * libclamav12-1.5.2-150400.13.5.1 * libfreshclam4-1.5.2-150400.13.5.1 * clamav-debugsource-1.5.2-150400.13.5.1 * libclammspack0-debuginfo-1.5.2-150400.13.5.1 * clamav-milter-debuginfo-1.5.2-150400.13.5.1 * clamav-1.5.2-150400.13.5.1 * clamav-devel-1.5.2-150400.13.5.1 * openSUSE Leap 15.4 (noarch) * clamav-docs-html-1.5.2-150400.13.5.1

* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)

* libclammspack0-1.5.2-150400.13.5.1

* clamav-debuginfo-1.5.2-150400.13.5.1

* libclamav12-debuginfo-1.5.2-150400.13.5.1

* libfreshclam4-debuginfo-1.5.2-150400.13.5.1

* clamav-milter-1.5.2-150400.13.5.1

* libclamav12-1.5.2-150400.13.5.1

* libfreshclam4-1.5.2-150400.13.5.1

* clamav-debugsource-1.5.2-150400.13.5.1

* libclammspack0-debuginfo-1.5.2-150400.13.5.1

* clamav-milter-debuginfo-1.5.2-150400.13.5.1

* clamav-1.5.2-150400.13.5.1

* clamav-devel-1.5.2-150400.13.5.1

* openSUSE Leap 15.4 (noarch)

* clamav-docs-html-1.5.2-150400.13.5.1

* bsc#1221954 * bsc#1258072 * bsc#1259207 * jsc#PED-14819 ## References: * * * * *

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Denial of Service Vulnerability in ClamAV Affects openSUSE and Fedora Systems A security update for ClamAV version 1.5.2 addresses a denial of service vulnerability identified as CVE-2026-20031. This vulnerability arises from improper error handling in the HTML CSS module when processing UTF-8 strings, potentially allowing attackers to exploit crafted HTML files. Affected systems include openSUSE Leap 15.4 and Fedora 37. The update also includes fixes for other issues, such as an infinite loop when scanning JPEG files and a crash caused by invalid pointer alignment. Users are advised to apply the updates using recommended installation methods like YaST or zypper patch. The vulnerability was published on March 4, 2026, and has a CVSS score of 6.9, indicating a medium severity level. This update is crucial for maintaining the security of systems running ClamAV. 2 sources 57

Extracted Entities

Attack Types (1)

DDoS

CVEs (2)

CVE-2026-20031 CVE-2026-20032