{"record":{"id":"088956c602ff2316","repo":"OrchardCMS/OrchardCore","slug":"the-clamav-antivirus-scanner-returned-an-unexpected-response","errorCode":null,"errorMessage":"The ClamAV antivirus scanner returned an unexpected response while scanning '{context.FileName}': {response}","messagePattern":"The ClamAV antivirus scanner returned an unexpected response while scanning '(.+?)': (.+?)","errorType":"exception","errorClass":"AntivirusScanningException","httpStatus":null,"severity":"error","filePath":"src/OrchardCore.Modules/OrchardCore.Antivirus/ClamAV/ClamAvFileEventHandler.cs","lineNumber":156,"sourceCode":"            var signature = response;\n            var separatorIndex = signature.IndexOf(\": \", StringComparison.Ordinal);\n\n            if (separatorIndex >= 0)\n            {\n                signature = signature[(separatorIndex + 2)..];\n            }\n\n            signature = signature[..^\" FOUND\".Length];\n\n            stream.Position = 0;\n\n            return FileCreatingResult.Failed(stream, new ResultError\n            {\n                Message = new LocalizedString(nameof(ClamAvFileEventHandler), $\"The uploaded file '{context.FileName}' was rejected because ClamAV detected '{signature}'.\"),\n            });\n        }\n\n        throw new AntivirusScanningException(\n            $\"The ClamAV antivirus scanner returned an unexpected response while scanning '{context.FileName}': {response}\");\n    }\n\n    private void ValidateOptions()\n    {\n        if (string.IsNullOrWhiteSpace(_options.Host))\n        {\n            throw new AntivirusScanningException(\"The ClamAV antivirus scanner is enabled but the host setting is missing.\");\n        }\n\n        if (_options.Port is < 1 or > 65535)\n        {\n            throw new AntivirusScanningException(\"The ClamAV antivirus scanner is enabled but the port setting is invalid.\");\n        }\n\n        if (_options.ConnectTimeoutSeconds <= 0)\n        {\n            throw new AntivirusScanningException(\"The ClamAV antivirus scanner is enabled but the connection timeout must be greater than zero.\");","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/OrchardCMS/OrchardCore/blob/4306c0717fe573f6fca1b4955909ddab6a192807/src/OrchardCore.Modules/OrchardCore.Antivirus/ClamAV/ClamAvFileEventHandler.cs#L138-L174","documentation":"TryCreateFailureResult parses the raw response line from clamd. Only \"stream: OK\" and \"... FOUND\" (virus detected) are recognized; anything else causes this AntivirusScanningException, so an unrecognized daemon reply fails the upload instead of being silently accepted.","triggerScenarios":"The ClamAV daemon returns a response that is neither \"stream: OK\" nor ends with \" FOUND\" — e.g. \"INSTREAM size limit exceeded. ERROR\", an error string, or a protocol-level message from an incompatible clamd version.","commonSituations":"Upload exceeds clamd's StreamMaxLength (returns \"size limit exceeded\"), clamd misconfigured to reply in a different format, a proxy/load balancer injecting its own response, or clamd version mismatch.","solutions":["Inspect the message's {response} value to see the actual daemon reply.","If it is \"INSTREAM size limit exceeded\", raise clamd's StreamMaxLength and the app-side limits.","Ensure the endpoint truly is a clamd INSTREAM listener (correct port, no HTTP proxy in the path).","Align clamd and OrchardCore.ClamAV versions/protocol expectations."],"exampleFix":"# before (clamd.conf)\nStreamMaxLength 10M\n# after\nStreamMaxLength 100M","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try\n{\n    await UploadFileAsync(stream);\n}\ncatch (AntivirusScanningException ex) when (ex.Message.Contains(\"unexpected response\"))\n{\n    // read ex.Message after ':' to inspect the raw clamd reply and act on it\n}","preventionTips":["Set clamd StreamMaxLength above your max upload to avoid 'size limit exceeded' replies.","Point the app directly at clamd (no HTTP proxies in between).","Keep the ClamAV module and clamd versions compatible.","Test with a known-clean file after any clamd config change."],"tags":["clamav","protocol","unexpected-response"],"backgroundTag":"unexpected-api-response-shape","analyzedSha":"4306c0717fe573f6fca1b4955909ddab6a192807","analyzedAt":"2026-09-13T17:41:05.024Z","contentChangedAt":"2026-09-13T17:41:05.024Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}