CVE-2026-20031 ClamAV CSS Image Parsing Error Handling Denial of Service Vulnerability
An unauthenticated remote attacker can cause a denial of service by submitting a crafted HTML file to ClamAV, terminating the scanning process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-20031?
CVE-2026-20031 is a medium-severity denial of service vulnerability in Cisco Secure Endpoint, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.
Weakness: CWE-248
Which versions are affected by CVE-2026-20031?
Linux distribution packages (16)
clamav SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 1.5.2-150400.13.5.1 |
clamav SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 1.5.2-150400.13.5.1 |
clamav SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 1.5.2-150400.13.5.1 |
clamav SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 1.5.2-150400.13.5.1 |
clamav SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.5.2-150600.18.25.1 |
clamav SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 1.5.2-3.53.1 |
clamav SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 1.5.2-150400.13.5.1 |
clamav SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 1.5.2-150400.13.5.1 |
clamav SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 1.5.2-150600.18.25.1 |
clamav SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.5.2-3.53.1 |
clamav SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 1.5.2-150400.13.5.1 |
clamav SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 1.5.2-150400.13.5.1 |
clamav SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 1.5.2-150600.18.25.1 |
clamav openSUSE:Leap 15.6 | All versions | 1.5.2-150600.18.25.1 |
clamav openSUSE:Leap 16.0 | All versions | 1.5.2-160000.1.1 |
clamav openSUSE:Tumbleweed | All versions | 1.5.2-1.1 |
How do I fix CVE-2026-20031?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-20031 being exploited?
There is no known exploitation of CVE-2026-20031 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-20031, GHSA-hvpm-hv6g-6m5c, MINI-4732-p28x-6h54, MINI-8j36-pr6j-mwcv, SUSE-SU-2026:0906-2, SUSE-SU-2026:1324-1 and 6 more.