CVE-2006-1989: Clam Anti-Virus Clamav

Medium severity, CVSS 5.1. EPSS: 5.8% chance of exploitation in the next 30 days.

Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers.

Affected products

• Clam Anti-Virus Clamav: version 0.88 only; version 0.88.1 only

Published 2006-05-01. Last modified 2026-06-16.