A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0906-2 advisory.

    Update to clamav 1.5.2:

    Security issue:

    - CVE-2026-20031: improper error handling in the HTML CSS module when splitting UTF-8 strings can lead to     denial of       service conditions via a crafted HTML file (bsc#1259207).

    Non security issue:

    - Support transactional updates (jsc#PED-14819).

    Changelog:

     * Fixed a possible infinite loop when scanning some JPEG files by      upgrading affected ClamAV dependency, a Rust image library.
     * The CVD verification process will now ignore certificate files      in the CVD certs directory when the user lacks read permissions.
     * Freshclam: Fix CLD verification bug with PrivateMirror option.
     * Upgraded the Rust bytes dependency to a newer version to      resolve RUSTSEC-2026-0007 advisory.
     * Fixed a possible crash caused by invalid pointer alignment on      some platforms.
     * Minimal required Rust version is now 1.87.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1631 advisory.

    A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated,     remote attacker to cause a denial of service (DoS) condition on an affected device.This vulnerability is     due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability     by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit     could allow the attacker to terminate the scanning process. (CVE-2026-20031)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1630 advisory.

    A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated,     remote attacker to cause a denial of service (DoS) condition on an affected device.This vulnerability is     due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability     by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit     could allow the attacker to terminate the scanning process. (CVE-2026-20031)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of clamav1.4 installed on the remote host is prior to 1.4.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3276 advisory.

    A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated,     remote attacker to cause a denial of service (DoS) condition on an affected device.This vulnerability is     due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability     by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit     could allow the attacker to terminate the scanning process. (CVE-2026-20031)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8207-1 advisory.

    It was discovered that ClamAV incorrectly handled certain HTML files. A remote attacker could possibly use     this issue to cause ClamAV to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20479-1 advisory.

    Update to clamav 1.5.2:

    Security issue:

    - CVE-2026-20031: improper error handling in the HTML CSS module when splitting UTF-8 strings can lead to     denial of       service conditions via a crafted HTML file (bsc#1259207).

    Non security issue:

    - Support transactional updates (jsc#PED-14819).

    Changelog:

     * Fixed a possible infinite loop when scanning some JPEG files by      upgrading affected ClamAV dependency, a Rust image library.
     * The CVD verification process will now ignore certificate files      in the CVD certs directory when the user lacks read permissions.
     * Freshclam: Fix CLD verification bug with PrivateMirror option.
     * Upgraded the Rust bytes dependency to a newer version to      resolve RUSTSEC-2026-0007 advisory.
     * Fixed a possible crash caused by invalid pointer alignment on      some platforms.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated,     remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is     due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability     by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit     could allow the attacker to terminate the scanning process. (CVE-2026-20031)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1325-1 advisory.

    Update to clamav 1.5.2:

    Security issue:

    - CVE-2026-20031: improper error handling in the HTML CSS module when splitting UTF-8 strings can lead to     denial of       service conditions via a crafted HTML file (bsc#1259207).

    Non security issue:

    - Support transactional updates (jsc#PED-14819).

    Changelog:

     * Fixed a possible infinite loop when scanning some JPEG files by      upgrading affected ClamAV dependency, a Rust image library.
     * The CVD verification process will now ignore certificate files      in the CVD certs directory when the user lacks read permissions.
     * Freshclam: Fix CLD verification bug with PrivateMirror option.
     * Upgraded the Rust bytes dependency to a newer version to      resolve RUSTSEC-2026-0007 advisory.
     * Fixed a possible crash caused by invalid pointer alignment on      some platforms.
     * Minimal required Rust version is now 1.87.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:1324-1 advisory.

    Update to clamav 1.5.2:

    - CVE-2026-20031: improper error handling in the HTML CSS module when splitting UTF-8 strings can lead to     denial of       service conditions via a crafted HTML file (bsc#1259207).

    Non security issue:

    - Support transactional updates (jsc#PED-14819).
    - Require main and library packages to be of the same version and release (bsc#1258072).

    Changelog:

     * Fixed a possible infinite loop when scanning some JPEG files by        upgrading affected ClamAV dependency, a Rust image library.
     * The CVD verification process will now ignore certificate files        in the CVD certs directory when the user lacks read permissions.
     * Freshclam: Fix CLD verification bug with PrivateMirror option.
     * Upgraded the Rust bytes dependency to a newer version to        resolve RUSTSEC-2026-0007 advisory.
     * Fixed a possible crash caused by invalid pointer alignment on        some platforms.
     * Minimal required Rust version is now 1.87.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, Cisco Secure Endpoint is affected by a denial of service (DoS) vulnerability.

  - A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an     unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected     device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An     attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by     ClamAV on an affected device. A successful exploit could allow the attacker to terminate the     scanning process. (CVE-2026-20031)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated,
    remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is
    due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability
    by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit
    could allow the attacker to terminate the scanning process. (CVE-2026-20031)

ID	Name	Product	Family	Severity
323241	SUSE SLES15: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:0906-2)	Nessus	SuSE Local Security Checks	medium
311324	Amazon Linux 2023 : clamav1.5, clamav1.5-data, clamav1.5-devel (ALAS2023-2026-1631)	Nessus	Amazon Linux Local Security Checks	medium
311310	Amazon Linux 2023 : clamav1.4, clamav1.4-data, clamav1.4-devel (ALAS2023-2026-1630)	Nessus	Amazon Linux Local Security Checks	medium
311213	Amazon Linux 2 : clamav1.4, --advisory ALAS2-2026-3276 (ALAS-2026-3276)	Nessus	Amazon Linux Local Security Checks	medium
310736	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : ClamAV vulnerability (USN-8207-1)	Nessus	Ubuntu Local Security Checks	medium
309135	openSUSE 16 Security Update : clamav (openSUSE-SU-2026:20479-1)	Nessus	SuSE Local Security Checks	medium
307028	Linux Distros Unpatched Vulnerability : CVE-2026-20031	Nessus	Misc.	medium
306484	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : clamav (SUSE-SU-2026:1325-1)	Nessus	SuSE Local Security Checks	medium
306480	SUSE SLES12 Security Update : clamav (SUSE-SU-2026:1324-1)	Nessus	SuSE Local Security Checks	medium
302191	Cisco Secure Endpoint ClamAV CSS Parsing DoS (cisco-sa-clamav-css-Fn4QSZ)	Nessus	CISCO	medium
438529	Alpine: multiple clamav packages, multiple freshclam packages: security update to 1.4.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
438529	Alpine: multiple clamav packages, multiple freshclam packages: security update to 1.4.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium

Detections

Analytics

CVE-2026-20031

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium