Skip to content
OpenAdvisories
Medium ALAS2-2026-3276 1 CVE

Moderate: clamav1.4 security update (Amazon Linux 2)

Published Apr 27, 2026 · Updated Apr 29, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-20031: A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 clamav1.4 0:1.4.4-1.amzn2.0.1
Amazon Linux · 2 clamav1.4-data 0:1.4.4-1.amzn2.0.1
Amazon Linux · 2 clamav1.4-debuginfo 0:1.4.4-1.amzn2.0.1
Amazon Linux · 2 clamav1.4-devel 0:1.4.4-1.amzn2.0.1
Amazon Linux · 2 clamav1.4-doc 0:1.4.4-1.amzn2.0.1
Amazon Linux · 2 clamav1.4-filesystem 0:1.4.4-1.amzn2.0.1
Amazon Linux · 2 clamav1.4-freshclam 0:1.4.4-1.amzn2.0.1
Amazon Linux · 2 clamav1.4-lib 0:1.4.4-1.amzn2.0.1
Amazon Linux · 2 clamav1.4-milter 0:1.4.4-1.amzn2.0.1
Amazon Linux · 2 clamd1.4 0:1.4.4-1.amzn2.0.1

Vulnerabilities 1

  • Medium 5.3
    CVE-2026-20031

    ClamAV CSS Image Parsing Error Handling Denial of Service Vulnerability

    A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting U…

    Cisco Cisco Secure Endpoint clamav clamav Network devices Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-20031.html