A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1325-1 advisory.

    Update to clamav 1.5.2:

    Security issue:

    - CVE-2026-20031: improper error handling in the HTML CSS module when splitting UTF-8 strings can lead to     denial of       service conditions via a crafted HTML file (bsc#1259207).

    Non security issue:

    - Support transactional updates (jsc#PED-14819).

    Changelog:

     * Fixed a possible infinite loop when scanning some JPEG files by      upgrading affected ClamAV dependency, a Rust image library.
     * The CVD verification process will now ignore certificate files      in the CVD certs directory when the user lacks read permissions.
     * Freshclam: Fix CLD verification bug with PrivateMirror option.
     * Upgraded the Rust bytes dependency to a newer version to      resolve RUSTSEC-2026-0007 advisory.
     * Fixed a possible crash caused by invalid pointer alignment on      some platforms.
     * Minimal required Rust version is now 1.87.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:1324-1 advisory.

    Update to clamav 1.5.2:

    - CVE-2026-20031: improper error handling in the HTML CSS module when splitting UTF-8 strings can lead to     denial of       service conditions via a crafted HTML file (bsc#1259207).

    Non security issue:

    - Support transactional updates (jsc#PED-14819).
    - Require main and library packages to be of the same version and release (bsc#1258072).

    Changelog:

     * Fixed a possible infinite loop when scanning some JPEG files by        upgrading affected ClamAV dependency, a Rust image library.
     * The CVD verification process will now ignore certificate files        in the CVD certs directory when the user lacks read permissions.
     * Freshclam: Fix CLD verification bug with PrivateMirror option.
     * Upgraded the Rust bytes dependency to a newer version to        resolve RUSTSEC-2026-0007 advisory.
     * Fixed a possible crash caused by invalid pointer alignment on        some platforms.
     * Minimal required Rust version is now 1.87.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, Cisco Secure Endpoint is affected by a denial of service (DoS) vulnerability.

  - A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an     unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected     device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An     attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by     ClamAV on an affected device. A successful exploit could allow the attacker to terminate the     scanning process. (CVE-2026-20031)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

ID	Name	Product	Family	Severity
306484	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : clamav (SUSE-SU-2026:1325-1)	Nessus	SuSE Local Security Checks	medium
306480	SUSE SLES12 Security Update : clamav (SUSE-SU-2026:1324-1)	Nessus	SuSE Local Security Checks	medium
302191	Cisco Secure Endpoint ClamAV CSS Parsing DoS (cisco-sa-clamav-css-Fn4QSZ)	Nessus	CISCO	medium

Detections

Analytics

CVE-2026-20031

medium

Tenable Plugins

medium

medium

medium