New ClamAV container blocked by CDN on first deployment

[Naros]

Describe the bug

I've just stood up a brand new set of docker services where we intended to use clamav; however, upon starting of the containers, we continously receive the output that we are being rate-limited.

freshclam daemon 1.5.1 (OS: Linux, ARCH: x86_64, CPU: x86_64)
ClamAV update process started at Sat Oct 25 07:05:50 2025
WARNING: FreshClam previously received error code 429 or 403 from the ClamAV Content Delivery Network (CDN).
This means that you have been rate limited or blocked by the CDN.
 1. Verify that you're running a supported ClamAV version.
    See https://docs.clamav.net/faq/faq-eol.html for details.
 2. Run FreshClam no more than once an hour to check for updates.
    FreshClam should check DNS first to see if an update is needed.
 3. If you have more than 10 hosts on your network attempting to download,
    it is recommended that you set up a private mirror on your network using
    cvdupdate (https://pypi.org/project/cvdupdate/) to save bandwidth on the
    CDN and your own network.
 4. Please do not open a ticket asking for an exemption from the rate limit,
    it will not be granted.
 5. If you have verified that you are not blocked due to your region, and have
    not exceeded the rate limit, please provide the following cf-ray id when
    submitting a ticket: 993fb8613e72d3c1-FRA

WARNING: You are still on cool-down until after: 2025-10-26 06:40:02

This is our very first deployment of clamav using a container and surprised we're getting this sort of issue.

How to reproduce the problem

/usr/bin # clamconf -n
Checking configuration files in /etc/clamav

Config file: clamd.conf
-----------------------
LogFile = "/var/log/clamav/clamd.log"
LogTime = "yes"
LocalSocket = "/tmp/clamd.sock"
TCPSocket = "3310"
User = "clamav"

Config file: freshclam.conf
---------------------------
UpdateLogFile = "/var/log/clamav/freshclam.log"
DatabaseMirror = "database.clamav.net"

Config file: clamav-milter.conf
-------------------------------
LogFile = "/var/log/clamav/milter.log"
LogTime = "yes"
User = "clamav"
ClamdSocket = "unix:/tmp/clamd.sock", "unix:/tmp/clamd.sock", "unix:/tmp/clamd.sock", "unix:/tmp/clamd.sock", "unix:/tmp/clamd.sock", "unix:/tmp/clamd.sock"
MilterSocket = "inet:7357"

Software settings
-----------------
Version: 1.5.1
Optional features supported: MEMPOOL AUTOIT_EA06 ICONV RAR 

Database information
--------------------
Database directory: /var/lib/clamav
Total number of signatures: 0

Platform information
--------------------
uname: Linux 6.8.0-71-generic #71-Ubuntu SMP PREEMPT_DYNAMIC Tue Jul 22 16:52:38 UTC 2025 x86_64
OS: Linux, ARCH: x86_64, CPU: x86_64
zlib version: 1.3.1 (1.3.1), compile flags: a9
platform id: 0x0a21e7e708000000000e0200

Build information
-----------------
GNU C: 14.2.0 (14.2.0)
sizeof(void*) = 8
Engine flevel: 231, dconf: 231

[val-ms]

Hi @Naros sorry for the delay. I wasn't able to look up the reason for your block yesterday.

We checked using the cf-ray id provided in your log output, and found that Cloudflare flagged your IP for bot activity and blocked the request. That's odd because we have disabled bot detection several times for database.clamav.net as freshclam activity is automated and so is expected to look like a bot. 😮‍💨

We've added your IP to a list to allow it and it should work now. We will also reach out to our cloudflare representative for assistance to find out why bot detection was (re)-enabled.

[vumdao]

Hi @val-ms

Can you please also help to check my case, whenever I retry after the cool-down, it set the new one?

{
  "errorMessage": "{\"source\": \"serverless-clamscan-update\", \"message\": \"FreshClam exited with unexpected code: 17\\nOutput: b\\\"ClamAV update process started at Wed Oct 29 01:27:12 2025\\\\nWARNING: Your ClamAV installation is OUTDATED!\\\\nWARNING: Local version: 0.103.12 Recommended version: 1.0.9\\\\nDON'T PANIC! Read https://docs.clamav.net/manual/Installing.html\\\\nWARNING: Cool-down expired, ok to try again.\\\\ndaily database available for update (local version: 27778, remote version: 27806)\\\\nWARNING: downloadPatch: Can't download daily-27779.cdiff from https://database.clamav.net/daily-27779.cdiff\\\\nWARNING: Incremental update failed, trying to download daily.cvd\\\\nWARNING: Can't download daily.cvd from https://database.clamav.net/daily.cvd\\\\nWARNING: FreshClam received error code 403 from the ClamAV Content Delivery Network (CDN).\\\\nThis could mean several things:\\\\n 1. You are running an out-of-date version of ClamAV / FreshClam.\\\\n    Ensure you are the most updated version by visiting https://www.clamav.net/downloads\\\\n 2. Your network is explicitly denied by the FreshClam CDN.\\\\n    In order to rectify this please check that you are:\\\\n   a. Running an up-to-date version of FreshClam\\\\n   b. Running FreshClam no more than once an hour\\\\n   c. If you have checked (a) and (b), please open a ticket at\\\\n      https://github.com/Cisco-Talos/clamav/issues\\\\n      and we will investigate why your network is blocked.\\\\nWARNING: You are on cool-down until after: 2025-10-30 01:27:17\\\\nERROR: Database update process failed: Forbidden; Blocked by CDN\\\\nERROR: Update failed.\\\\n\\\"\"}",
  "errorType": "Exception",
  "requestId": "d9f3f2fb-9fbb-4841-8d55-57ef6738a05b",
  "stackTrace": [
    "  File \"/var/lang/lib/python3.12/site-packages/aws_lambda_powertools/logging/logger.py\", line 548, in decorate\n    return lambda_handler(event, context, *args, **kwargs)\n",
    "  File \"/var/task/lambda.py\", line 33, in lambda_handler\n    freshclam_update(download_path)\n",
    "  File \"/var/task/lambda.py\", line 70, in freshclam_update\n    report_failure(e.message)\n",
    "  File \"/var/task/lambda.py\", line 80, in report_failure\n    raise Exception(json.dumps(exception_json))\n"
  ]
}

START RequestId: 4e122157-7ed2-4442-bf2b-8cf23ca4a02c Version: $LATEST
{"level":"INFO","location":"decorate:538","message":{"key1":"value1","key2":"value2","key3":"value3"},"timestamp":"2025-10-29 01:31:45,530+0000","service":"freshclam-update","cold_start":false,"function_name":"test-testServerlessClamscantestServ-cpUzGtLMdHOT","function_memory_size":"1024","function_arn":"arn:aws:lambda:eu-central-1:975049911096:function:test-testServerlessClamscantestServ-cpUzGtLMdHOT","function_request_id":"4e122157-7ed2-4442-bf2b-8cf23ca4a02c","xray_trace_id":"1-69016e81-136f10fb76c0321341f0ee37"}
{"key1": "value1", "key2": "value2", "key3": "value3"}
Output: ClamAV update process started at Wed Oct 29 01:31:45 2025
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.103.12 Recommended version: 1.0.9
DON'T PANIC! Read https://docs.clamav.net/manual/Installing.html
WARNING: FreshClam previously received error code 429 or 403 from the ClamAV Content Delivery Network (CDN).
This means that you have been rate limited or blocked by the CDN.
1. Verify that you're running a supported ClamAV version.
See https://docs.clamav.net/faq/faq-eol.html for details.
2. Run FreshClam no more than once an hour to check for updates.
FreshClam should check DNS first to see if an update is needed.
3. If you have more than 10 hosts on your network attempting to download,
it is recommended that you set up a private mirror on your network using
cvdupdate (https://pypi.org/project/cvdupdate/) to save bandwidth on the
CDN and your own network.
4. Please do not open a ticket asking for an exemption from the rate limit,
it will not be granted.
WARNING: You are still on cool-down until after: 2025-10-30 01:27:17
END RequestId: 4e122157-7ed2-4442-bf2b-8cf23ca4a02c
REPORT RequestId: 4e122157-7ed2-4442-bf2b-8cf23ca4a02c	Duration: 66.53 ms	Billed Duration: 67 ms	Memory Size: 1024 MB	Max Memory Used: 314 MB	

[val-ms]

@vumdao you're running a version (Local version: 0.103.12) that is past end of life and is blocked from updates. You will have to upgrade to a newer version (1.0.9 or higher) to continue to download signature updates).

Edit: for more details: https://docs.clamav.net/faq/faq-eol.html#version-support-matrix

[vumdao]

Thanks @val-ms
I used dnf -y install clamav but it just installed version 0.103.12. Do we have any workaround ?

[Naros]

We've added your IP to a list to allow it and it should work now. We will also reach out to our cloudflare representative for assistance to find out why bot detection was (re)-enabled.

Hi @val-ms, thank you for the response, and going the extra mile by whitelisting the IP address. Hopefully you find the reason for why cloudflare re-enabled the bot detection mechanism.

[val-ms]

@vumdao A newer version may not be provided by the version of your linux distribution.

One option is to upgrade to a newer version of your chosen Linux distribution.

If you're using dnf for packages, I assume you're using RHEL 8 or similar. The ClamAV project provides RPM packages which are presently being built on AlmaLinux 8. It should work on RHEL 8, RockyLinux 8, etc. They're available for each ClamAV release from https://github.com/Cisco-Talos/clamav/releases or https://www.clamav.net/downloads
More info here: https://docs.clamav.net/manual/Installing.html#rpm-packages-for-almalinux-fedora-opensuse-etc

The configuration is a little bit different for ClamAV project provided installers as compared with ones provided by Linux distributions. For ClamAV project provided installer packages, you'll find the files here:

• applications in /usr/local/bin
• daemons in /usr/local/sbin
• libraries in /usr/local/lib
• headers in /usr/local/include
• configs in /usr/local/etc/
• databases in /usr/local/share/clamav/

[wolfgangkarall]

@val-ms Hi, I'm seeing the same problem on a new deployment, I can open another ticket if you like, but I'll try first in this comment. :)

The information from the logs just now:
clamav | 2025-11-01T08:28:49.158658144Z Please provide the following cf-ray id with your ticket: 997a0555cc71dc72-FRA