ClamAV 1.5.3 fails to initialize MD5 under Ubuntu 24.04 FIPS, causing EICAR detection failure

Author: danixtechCreated Jul 31, 2026Updated Sep 10, 2026

Describe the bug

ClamAV 1.5.3 running on Ubuntu 24.04 with enforced FIPS mode is unable to initialize an MD5 hash context in libclamav.

A valid canonical EICAR test file consequently scans as clean (OK) rather than being detected.

The issue reproduces with both clamscan and clamdscan.

Explicitly using clamscan --fips-limits does not change the behavior.

ClamAV is otherwise operational on this host and has successfully detected other signatures, including phishing detections. This does not appear to be a general failure to load the virus databases.

Environment

OS: Ubuntu 24.04 LTS
Architecture: x86_64
ClamAV: 1.5.3
ClamAV functionality level: 233
Kernel: Linux 6.8.0-136-fips
FIPS enabled: yes

Authoritative FIPS state:

bash

$ cat /proc/sys/crypto/fips_enabled
1

ClamAV configuration:

bash

$ clamconf | grep -i FIPS
FIPSCryptoHashLimits disabled
FIPSCryptoHashLimits disabled
uname: Linux 6.8.0-136-fips #136+fips2-Ubuntu SMP PREEMPT_DYNAMIC x86_64

The database directory contains the standard databases and detached signatures:

bytecode.cvd
bytecode-339.cvd.sign
daily.cvd
daily-28055.cvd.sign
main.cvd
main-63.cvd.sign
freshclam.dat

A normal scan reports approximately 3.6 million known signatures.

Test File

The canonical 68-byte EICAR test file was used.

bash

$ wc -c eicar.com.txt
68 eicar.com.txt

$ file eicar.com.txt
eicar.com.txt: EICAR virus test files

$ sha256sum eicar.com.txt
275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f  eicar.com.txt

How to reproduce the problem

1. Confirm FIPS mode

bash

$ cat /proc/sys/crypto/fips_enabled
1

2. Generate an MD5 signature using ClamAV's sigtool

bash

$ sigtool --md5 eicar.com.txt
LibClamAV Error: cli_hashstream: Unable to initialize hash context for md5
ERROR: hashsig: Can't generate hash for eicar.com.txt

3. Generate SHA-256 using sigtool

SHA-256 works normally:

bash

$ sigtool --sha256 eicar.com.txt
275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f:68:eicar.com.txt

4. Compare with system hash utilities

The operating system can calculate both hashes:

bash

$ md5sum eicar.com.txt
44d88612fea8a8f36de82e1278abb02f  eicar.com.txt

$ sha256sum eicar.com.txt
275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f  eicar.com.txt

This suggests the MD5 initialization failure is specific to the crypto path used by libclamav.

5. Scan with clamscan

bash

$ clamscan eicar.com.txt

Loading: [========================>] 3.63M/3.63M sigs
Compiling: [========================>] 41/41 tasks

LibClamAV Error: cli_scan_fmap: Error initializing md5 hash context
LibClamAV Error: cli_scan_fmap: Error initializing md5 hash context
eicar.com.txt: OK

----------- SCAN SUMMARY -----------
Known viruses: 3627891
Engine version: 1.5.3
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0 B
Data read: 68 B

6. Scan through clamd

bash

$ clamdscan --fdpass eicar.com.txt
eicar.com.txt: OK

----------- SCAN SUMMARY -----------
Infected files: 0

7. Test explicit FIPS limits

bash

$ clamscan --fips-limits eicar.com.txt

Loading: [========================>] 3.63M/3.63M sigs
Compiling: [========================>] 41/41 tasks

LibClamAV Error: cli_scan_fmap: Error initializing md5 hash context
LibClamAV Error: cli_scan_fmap: Error initializing md5 hash context
eicar.com.txt: OK

----------- SCAN SUMMARY -----------
Known viruses: 3627891
Engine version: 1.5.3
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0 B
Data read: 68 B

Expected Behavior

I expected ClamAV 1.5.3 to handle the hash operations needed for signature evaluation correctly while operating on a FIPS-enabled host.

For the canonical EICAR file, I expected a detection rather than:

eicar.com.txt: OK

If MD5-backed signatures cannot be evaluated in this environment, I would also expect ClamAV to expose that limitation clearly rather than return a clean result after an MD5 initialization error.

Actual Behavior

libclamav reports:

cli_scan_fmap: Error initializing md5 hash context

but scanning continues and reports:

eicar.com.txt: OK

The same behavior occurs with --fips-limits.

Additional Observations

SHA-256 hashing through libclamav works.
md5sum supplied by the operating system works.
ClamAV successfully loads approximately 3.6 million signatures.
Other ClamAV detections have been observed on this host, including phishing detections.
This therefore appears specific to an MD5-dependent scan/signature path rather than a complete database loading failure.

Questions

Is failure to initialize an MD5 hash context expected on an Ubuntu FIPS-enabled host?
Should ClamAV 1.5.x be able to evaluate MD5/HDB signatures for detection purposes under FIPS mode?
What behavior is FIPSCryptoHashLimits / --fips-limits expected to provide in this scenario?
Can this condition affect other MD5-backed signatures in addition to EICAR?
Should failure to initialize a required hash context result in a scan error instead of returning OK?

I can provide additional sanitized diagnostic output if useful, including package provenance, signature database metadata, and debug scan output.

clamconf -n

bash

Checking configuration files in /etc/clamav

Config file: clamd.conf
-----------------------
LogFile = "/var/log/clamav/clamav.log"
LogFileMaxSize = "9223372036854775807"
LogTime = "yes"
LogClean = "yes"
LogSyslog = "yes"
LogVerbose = "yes"
LogRotate = "yes"
ExtendedDetectionInfo = "yes"
PidFile = "/var/run/clamav/clamd.pid"
TemporaryDirectory = "/tmp"
LocalSocket = "/var/run/clamav/clamd.ctl"
LocalSocketGroup = "clamav"
LocalSocketMode = "666"
MaxConnectionQueueLength = "15"
StreamMaxLength = "26214400"
MaxThreads = "12"
ReadTimeout = "180"
SendBufTimeout = "200"
SelfCheck = "3600"
User = "clamav"
BytecodeTimeout = "60000"
MaxScanTime = "120000"
MaxScanSize = "4293918720"
MaxFileSize = "4293918720"
MaxRecursion = "16"
MaxEmbeddedPE = "10485760"
MaxHTMLNormalize = "10485760"
MaxHTMLNoTags = "2097152"
MaxScriptNormalize = "5242880"
PCREMatchLimit = "10000"
PCRERecMatchLimit = "5000"
PCREMaxFileSize = "26214400"
*** ScanOnAccess is DEPRECATED ***

Config file: freshclam.conf
---------------------------
LogFileMaxSize = "9223372036854775807"
LogTime = "yes"
LogRotate = "yes"
PidFile = "/var/run/clamav/freshclam.pid"
UpdateLogFile = "/var/log/clamav/freshclam.log"
Checks = "24"
DatabaseMirror = "db.local.clamav.net", "database.clamav.net"
PrivateMirror = "https://<REDACTED>"
MaxAttempts = "5"
ReceiveTimeout disabled

clamav-milter.conf not found

Software settings
-----------------
Version: 1.5.3
Optional features supported: MEMPOOL AUTOIT_EA06 ICONV

Database information
--------------------
Database directory: /var/lib/clamav
main.cvd: version 63, sigs: 3287027, built on Tue Dec 16 15:18:22 2025
bytecode.cvd: version 339, sigs: 80, built on Thu Sep 11 05:29:19 2025
daily.cvd: version 28055, sigs: 355485, built on Wed Jul  8 23:25:20 2026
Total number of signatures: 3642592

Platform information
--------------------
uname: Linux 6.8.0-136-fips #136+fips2-Ubuntu SMP PREEMPT_DYNAMIC Tue Jul  7 19:13:25 UTC 20 x86_64
OS: Linux, ARCH: x86_64, CPU: x86_64
Full OS version: Ubuntu 24.04.4 LTS
zlib version: 1.3 (1.3), compile flags: a9
platform id: 0x0a21e9e908000000000d0300

Build information
-----------------
GNU C: 13.3.0 (13.3.0)
sizeof(void*) = 8
Engine flevel: 233, dconf: 233

Attachments

https://secure.eicar.org/eicar.com.txt

Source: Cisco-Talos/clamav

View original on GitHub View discussion on GitHub