Skip to content
OpenAdvisories
Medium ALAS2023-2026-1631 1 CVE

Moderate: clamav1.5 security update (Amazon Linux 2023)

Published Apr 27, 2026 · Updated Apr 30, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-20031: A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.

Fixed packages 15

ReleasePackageFixed in
Amazon Linux · 2023 clamav1.5 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamav1.5-data 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamav1.5-debuginfo 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamav1.5-debugsource 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamav1.5-devel 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamav1.5-doc 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamav1.5-filesystem 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamav1.5-freshclam 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamav1.5-freshclam-debuginfo 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamav1.5-lib 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamav1.5-lib-debuginfo 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamav1.5-milter 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamav1.5-milter-debuginfo 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamd1.5 0:1.5.2-1.amzn2023.0.1
Amazon Linux · 2023 clamd1.5-debuginfo 0:1.5.2-1.amzn2023.0.1

Vulnerabilities 1

  • Medium 5.3
    CVE-2026-20031

    ClamAV CSS Image Parsing Error Handling Denial of Service Vulnerability

    A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting U…

    Cisco Cisco Secure Endpoint clamav clamav Network devices Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-20031.html