Read the docs
TI-2019-12004 Aliases CVE-2019-15961GHSA-4w5h-pwr8-qh64

Clam AntiVirus (ClamAV) Software Email Parsing Vulnerability

Priority MEDIUM 44CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to scan the crafted email file indefinitely, resulting in a denial of service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03135 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ClamAV (ClamAV): 0.101.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ClamAVClamAVup to 0.102.0; before 0.101.40.101.4Patch availableCNA
  • ClamAV VendorClamAV Affected up to 0.102.0; before 0.101.4 Fixed in 0.101.4 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*up to 0.101.4VulnerableClamAV
cpe:2.3:a:clamav:clamav:0.102.0:*:*:*:*:*:*:*0.102.0VulnerableClamAV
cpe:2.3:o:cisco:email_security_appliance_firmware:11.1.1-042:*:*:*:*:*:*:*11.1.1-042VulnerableCisco
cpe:2.3:o:cisco:email_security_appliance_firmware:11.1.2-023:*:*:*:*:*:*:*11.1.2-023VulnerableCisco
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*14.04VulnerableCanonical
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
  • cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:* Versions up to 0.101.4 Vulnerable ·ClamAV
  • cpe:2.3:a:clamav:clamav:0.102.0:*:*:*:*:*:*:* Versions 0.102.0 Vulnerable ·ClamAV
  • cpe:2.3:o:cisco:email_security_appliance_firmware:11.1.1-042:*:*:*:*:*:*:* Versions 11.1.1-042 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:email_security_appliance_firmware:11.1.2-023:*:*:*:*:*:*:* Versions 11.1.2-023 Vulnerable ·Cisco
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian

Remediation

  • Fix · CNA ClamAV (ClamAV) Fixed in 0.101.4

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-15961
  2. 2026-10-03 Alias added: GHSA-4w5h-pwr8-qh64

References

Exploit 1

Advisory 4

  • TI-2024-13262 ClamAV VirusEvent File Processing Command Injection Vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2023-06741 Buffer overflow in Cisco Secure Web Appliance CVSS 3.1CRITICAL 9.8
  • TI-2012-01281 The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir… CVSS 2.0MEDIUM 4.3
  • TI-2012-01279 The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!… CVSS 2.0MEDIUM 4.3
  • TI-2012-01265 The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat… CVSS 2.0MEDIUM 4.3
  • TI-2017-09151 Memory corruption in ClamAV AntiVirus software versions 0.99.2 and prior CVSS 3.0CRITICAL 9.8
See all 102 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences