CVE-2024-20380: ClamAV HTML Parser DoS Vulnerability

CVE-2024-20380 Overview

CVE-2024-20380 is a denial of service (DoS) vulnerability in the HTML parser of ClamAV, an open-source antivirus engine maintained by Cisco. The flaw resides in the C to Rust foreign function interface (FFI) used by the HTML parsing component. An unauthenticated, remote attacker can exploit this vulnerability by submitting a crafted file containing HTML content for ClamAV to scan. Successful exploitation terminates the ClamAV scanning process, disrupting malware detection on the affected host.

Critical Impact
Remote, unauthenticated attackers can crash the ClamAV scanning engine by submitting a single crafted HTML file, disabling antivirus protection on mail gateways, file servers, and security appliances that rely on ClamAV.

Affected Products

ClamAV 1.3.0
ClamAV 1.3.0-rc
ClamAV 1.3.0-rc2

Discovery Timeline

2024-04-18 - CVE-2024-20380 published to NVD
2024-04-17 - ClamAV releases patched versions 1.3.1, 1.2.3, and 1.0.6 via the ClamAV Blog Patch Announcement
2025-07-23 - Last updated in NVD database

Technical Details for CVE-2024-20380

Vulnerability Analysis

The vulnerability is classified as [CWE-475] Undefined Behavior for Input to API. It manifests at the boundary where ClamAV's C codebase invokes Rust functions through the foreign function interface. ClamAV introduced Rust components in recent versions to harden specific parsers, including the HTML normalization logic. When the C caller passes malformed or unexpected data structures across the FFI boundary, the Rust side encounters undefined behavior that terminates the scanning process.

The attack requires no authentication and no user interaction. Any service that routes attacker-controlled files to ClamAV for scanning can trigger the crash. This includes mail transfer agents, web upload scanners, file shares, and security gateways.

Root Cause

The root cause is an incorrect contract between the C caller and the Rust callee in the HTML parser. The Rust function assumes invariants about the input that the C side does not enforce. When a crafted HTML payload violates these assumptions, the Rust runtime aborts execution, killing the scanning process. The defect is data-only, so memory corruption and code execution are not possible.

Attack Vector

An attacker delivers a crafted HTML file through any channel that feeds ClamAV. Common vectors include email attachments scanned by ClamAV-integrated mail filters, file uploads scanned by web application gateways, and files transferred to ClamAV-protected storage. When clamd or clamscan processes the file, the HTML parser invokes the vulnerable FFI path and the process exits. Subsequent scans fail until the daemon restarts, creating a window where malware can transit the protection layer undetected.

No verified proof-of-concept code is publicly available for this vulnerability. Refer to the ClamAV Blog Patch Announcement for vendor technical details.

Detection Methods for CVE-2024-20380

Indicators of Compromise

Unexpected termination of clamd or clamscan processes immediately after scanning an HTML file or HTML-containing archive.
Repeated ClamAV daemon restarts logged in systemd, init, or supervisor logs without administrator action.
Spikes in unscanned files queued at mail gateways, web proxies, or file shares that depend on ClamAV.
Crash entries referencing the ClamAV HTML parser or Rust runtime panic messages in system logs.

Detection Strategies

Monitor ClamAV process lifecycle events and alert on abnormal exit codes or unexpected restarts within short time windows.
Correlate scan failures with the file types being processed, focusing on HTML payloads and archives containing HTML content.
Inspect installed ClamAV versions across the fleet and flag any host running 1.3.0, 1.3.0-rc, or 1.3.0-rc2.

Monitoring Recommendations

Forward clamd stdout, stderr, and journal logs to a centralized logging platform for crash pattern analysis.
Track scan throughput metrics and alert when scan queues grow due to repeated daemon failures.
Audit upstream services (mail, web, storage) for files that triggered scanner timeouts or errors near the time of a ClamAV crash.

How to Mitigate CVE-2024-20380

Immediate Actions Required

Upgrade ClamAV to version 1.3.1, 1.2.3, or 1.0.6 or later, depending on the deployed release branch.
Identify all systems running ClamAV 1.3.0, 1.3.0-rc, or 1.3.0-rc2 and prioritize them for patching.
Restart clamd after upgrading to ensure the patched binaries are loaded into memory.
Configure process supervisors to automatically restart clamd as an interim availability safeguard.

Patch Information

ClamAV released fixed versions 1.3.1, 1.2.3, and 1.0.6 to address CVE-2024-20380. The patches correct the C to Rust FFI handling in the HTML parser so that crafted input no longer terminates the scanning process. Full release details are available in the ClamAV Blog Patch Announcement.

Workarounds

No vendor-supplied workaround removes the vulnerable code path; upgrading is the only complete remediation.
As a temporary measure, restrict the file types passed to ClamAV at upstream services, deferring HTML scanning where business risk allows.
Deploy automatic service recovery for clamd so denial of service windows are minimized while patching is scheduled.

bash

# Verify ClamAV version and upgrade on Debian/Ubuntu systems
clamscan --version
sudo apt-get update && sudo apt-get install --only-upgrade clamav clamav-daemon
sudo systemctl restart clamav-daemon