CVE-2024-20380 ClamAV HTML Parser Denial of Service Vulnerability

What is CVE-2024-20380?

CVE-2024-20380 is a high-severity denial of service vulnerability in Clamav Clamav, published on 18 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an issue in the C to Rust foreign function interface. An attacker could exploit this vulnerability by submitting a crafted file containing HTML content to be scanned by ClamAV on an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Weakness: CWE-475

Which versions are affected by CVE-2024-20380?

It affects 1 product.

Products include Clamav Clamav.

How do I fix CVE-2024-20380?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-20380 being exploited?

There is no known exploitation of CVE-2024-20380 in the wild and no public exploit code.

Other vulnerabilities in Clamav Clamav

• CVE-2010-0098 Security feature bypass in n/a Critical 10.0
• CVE-2009-1372 Memory corruption in n/a Critical 10.0
• CVE-2008-3914 Denial of service in n/a Critical 10.0
• CVE-2008-0728 Memory corruption in n/a Critical 10.0
• CVE-2006-1615 Other in n/a Critical 10.0

All Clamav Clamav vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m2rv-2ggp-66m7, openSUSE-SU-2024:14087-1.