https://cybertoolchain.io/tools/clamav New releases and features in ClamAV, tracked by The Cyber Toolchain. en Tue, 07 Oct 2025 13:32:12 GMT https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.5.0 https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.5.0 Tue, 07 Oct 2025 13:32:12 GMT ClamAV 1.5.0 adds URI extraction from HTML/PDF, CVD external signing, FIPS limits, per-file hash/type logging, and rich new libclamav scan APIs. • Detects whether OLE2-based Microsoft Office documents are encrypted. • Adds URI extraction from HTML documents into JSON metadata, with `--json-store-html-uris=no` / `JsonStoreHTMLURIs no` to opt out. • Adds URI extraction from PDF documents into JSON metadata, with `--json-store-pdf-uris=no` / `JsonStorePDFURIs no` to opt out. • Supports regex patterns in the `clamd.conf` `OnAccessExcludePath` option for fine-grained on-access scan exclusions. • Adds CVD signing/verification via external `.sign` files; Freshclam downloads matching signature files automatically, and Sigtool gains sign/verify commands for them. • Adds `--cvdcertsdir` CLI option and `CVDCertsDirectory` config option (plus `CVD_CERTS_DIR` env var) across Freshclam, ClamD, ClamScan, and Sigtool to specify a custom CVD certificates directory. • Adds new libclamav APIs `cl_cvdverify_ex` and `cl_cvdunpack_ex` for verifying and unpacking CVDs with an explicit certs directory. • Adds FIPS-like crypto hash limits (`--fips-limits` / `FIPSCryptoHashLimits yes` / `CL_ENGINE_FIPS_LIMITS`) to disable MD5 and SHA1 for signature verification and false-positive trust checks. • Upgrades the clean-file scan cache from MD5 to SHA2-256, enabling operation in FIPS-mode environments. • Adds `clamd.conf` options (`EnableShutdownCommand`, `EnableReloadCommand`, `EnableStatsCommand`, `EnableVersionCommand`) to selectively disable ClamD administrative socket commands. • Adds extended libclamav hashing APIs (`cl_hash_data_ex`, `cl_hash_init_ex`, `cl_finish_hash_ex`, `cl_hash_file_fd_ex`, etc.) with a `flags` parameter to control FIPS hash algorithm limits. • Adds ClamScan options `--hash-hint`, `--log-hash`, `--hash-alg`, `--file-type-hint`, and `--log-file-type` for per-file hash pre-supply and post-scan hash/type reporting. • Adds new libclamav scan functions `cl_scanfile_ex`, `cl_scandesc_ex`, and `cl_scanmap_ex` supporting hash hints, hash output, hash algorithm selection, file-type hints, and file-type output. • Adds `CL_ENGINE_TMPDIR_RECURSION` engine option to libclamav for independently toggling temp directory recursion without requiring `--leave-temps`. • Adds `cl_engine_set_scan_callback` API with five callback insertion points (`CL_SCAN_CALLBACK_PRE_HASH`, `CL_SCAN_CALLBACK_PRE_SCAN`, `CL_SCAN_CALLBACK_POST_SCAN`, `CL_SCAN_CALLBACK_ALERT`, `CL_SCAN_CALLBACK_FILE_TYPE`) allowing callers to inspect or alter scan behavior at each stage. • ClamScan scan summary now reports bytes-scanned and bytes-read in exact GiB/MiB/KiB/B units instead of always using MB. Breaking changes: • The original `cl_cvdverify` and `cl_cvdunpack` libclamav functions are deprecated in favour of `cl_cvdverify_ex` and `cl_cvdunpack_ex`. • The older cl_scan*() functions (`cl_scanfile`, `cl_scandesc`, `cl_scanmap`) are deprecated and may be removed in a future release. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clamav https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.4.0 https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.4.0 Thu, 15 Aug 2024 16:02:17 GMT ClamAV 1.4.0 adds ALZ and LHA/LZH archive extraction and granular image fuzzy-hash scan controls. • Supports extraction and scanning of ALZ archives (new file type `CL_TYPE_ALZ`), with a DCONF toggle to enable/disable. • Supports extraction and scanning of LHA/LZH archives (new file type `CL_TYPE_LHA_LZH`), with a DCONF toggle to enable/disable. • Adds `--scan-image` and `--scan-image-fuzzy-hash` ClamScan flags to independently control image scanning and fuzzy-hash-based image detection. • Adds `ScanImage` and `ScanImageFuzzyHash` ClamD config options for daemon-level control over image fuzzy hashing. • Exposes `CL_SCAN_PARSE_IMAGE` and `CL_SCAN_PARSE_IMAGE_FUZZY_HASH` libclamav scan option flags for programmatic control. • Adds optimization that skips file hash calculation when the clean file cache is disabled and no matching hash-based signatures exist, reducing unnecessary CPU work. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clamav https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.3.1 https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.3.1 Wed, 17 Apr 2024 17:25:20 GMT ClamAV 1.3.1 adds 'valhalla' optional database and fixes `DatabaseCustomURL` pruning bug • Adds the new 'valhalla' database name to the list of optional databases in preparation for future work Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clamav https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.2.3 https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.2.3 Wed, 17 Apr 2024 17:24:56 GMT ClamAV 1.2.3 adds the 'valhalla' database name to optional databases. • Adds `valhalla` to the list of optional database names for use with Freshclam. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clamav https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.0.6 https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.0.6 Wed, 17 Apr 2024 17:24:37 GMT ClamAV 1.0.6 adds 'valhalla' as an optional database name. • Adds the new 'valhalla' database name to the list of optional databases in preparation for future work Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clamav https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.3.0 https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.3.0 Wed, 07 Feb 2024 16:06:56 GMT ClamAV 1.3.0 adds OneNote attachment scanning and pyc file type recognition • Adds support for extracting and scanning attachments in Microsoft OneNote section files via `--scan-onenote=no` flag, `ScanOneNote no` config option, or `CL_SCAN_PARSE_ONENOTE` libclamav constant Breaking changes: • ClamD now exits with code 1 and prints an error if the directory specified by `TemporaryDirectory` in `clamd.conf` does not exist Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clamav https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.2.0 https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.2.0 Mon, 28 Aug 2023 21:34:51 GMT ClamAV 1.2.0 adds UDF partition extraction, client cert auth for Freshclam, systemd timer support, and larger MaxScanSize limits • Adds `--cache-size` CLI flag to `clamd` and `clamscan`, plus `CacheSize` config key in `clamd.conf` to customize the clean file cache size. • Introduces `clamav-freshclam-once.timer` SystemD unit for running Freshclam updates on a schedule without backgrounding the daemon. • Adds ability to authenticate Freshclam to private mirrors using client certificates via the `FRESHCLAM_CLIENT_CERT`, `FRESHCLAM_CLIENT_KEY`, and `FRESHCLAM_CLIENT_KEY_PASSWD` environment variables. • Raises `MaxScanSize` limit beyond 4 GB and adds 'G'/'g' suffix support for gigabytes in both `clamd.conf` (`MaxScanSize`) and `clamscan` (`--max-scansize`). • Adds support for extracting UDF partitions, specifically the Beginning Extended Area Descriptor (BEA01) type. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clamav https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.1.0 https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.1.0 Mon, 01 May 2023 19:44:14 GMT ClamAV 1.1.0 adds `--fail-if-cvd-older-than`, libclamav API for VBA callbacks and DB age, plus Sigtool extraction fixes • Adds the new ClamD option `--fail-if-cvd-older-than` and its config key `FailIfCvdOlderThan` to exit startup if the virus database is too old • Adds the function cl_cvdgetage() to libclamav API to retrieve the age in seconds of a database directory or CVD/CLD file • Adds the function cl_engine_set_clcb_vba() to libclamav API to set a callback for normalized VBA extraction from Office documents • Adds ClamAV ability to extract images embedded in HTML CSS `<style>` blocks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clamav https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.0.0 https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.0.0 Mon, 28 Nov 2022 20:09:21 GMT ClamAV 1.0.0 adds `clcb_file_inspection` API callback and cl_cvdunpack() for CVD verification • cl_cvdunpack() function added to public API for unpacking CVD signature archives with optional signature verification. • New `clcb_file_inspection` callback type defined in `clamav.h`, enabled via cl_engine_set_clcb_file_inspection(), allows inspecting file content during archive extraction at each layer. • Decryption of read-only OLE2-based XLS files encrypted with the default password is now supported, with the default password appearing in metadata JSON. Breaking changes: • The `ENABLE_EXTERNAL_TOMSFASTMATH` build option is removed and ignored; ClamAV no longer supports building with an external TomsFastMath library. • The SONAME major version for libclamav has increased due to ABI changes between the 0.103 LTS release and the 1.0 LTS release, requiring re-linking. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clamav