FreshClam received error code 403 from the ClamAV Content Delivery Network (CDN)

[lbtor]

I don't know how to report this issue as the instructions provided direct to the bugzilla that was shut down 3 years ago. I am using the most up to date version of ClamAV.

Describe the bug

ClamAV update process started at Thu Jul 16 09:44:22 2026
daily database available for update (local version: 26193, remote version: 28062)
Current database is 1869 versions behind.
Downloading database patch # 26194...
WARNING: downloadPatch: Can't download daily-26194.cdiff from https://database.clamav.net/daily-26194.cdiff
WARNING: Can't download daily.cvd from https://database.clamav.net/daily.cvd
WARNING: FreshClam received error code 403 from the ClamAV Content Delivery Network (CDN).
This could mean several things:

1. You are running an out-of-date version of ClamAV / FreshClam.
   Ensure you are the most updated version by visiting https://www.clamav.net/downloads
2. Your network is explicitly denied by the FreshClam CDN.
   In order to rectify this please check that you are:
   a. Running an up-to-date version of FreshClam
   b. Running FreshClam no more than once an hour
   c. If you have checked (a) and (b), please open a ticket at
   https://bugzilla.clamav.net under the 'Mirrors' component
   and we will investigate why your network is blocked.
   ERROR: Database update process failed: Forbidden; Blocked by CDN
   ERROR: Update failed.

[val-ms]

Your clamav version must be very old, and that will get you blocked. Upgrade to a newer version and it should work.

[oreactko]

same issue,even in lastest version

[sueess86]

Description

Our server has been receiving HTTP 403 responses from database.clamav.net since
approximately January 2026. The local daily database is stuck at version 27887
(dated Jan 21, 2026); the current remote version is 28065, so we are ~178
versions behind and our clamd no longer starts (signature verification of the
outdated CVDs fails under ClamAV 1.5.x).

We believe we comply with the usage guidelines and would like to ask why our
IP/network is blocked.

Checks performed

• ClamAV / FreshClam version: 1.5.3 (up to date; DNS TXT advertises 1.4.5)
• Update frequency: freshclam daemon config uses Checks 24 (hourly);
  no additional cron jobs. FreshClam's own cool-down is respected.
• Region: Switzerland (Cloudflare PoP ZRH) — not an embargoed region.
• Network path verified: DNS resolution OK (current.cvd.clamav.net TXT
  query succeeds), TCP + TLS 1.3 handshake to Cloudflare completes, certificate
  valid. The 403 is returned by the CDN itself, both for cdiff patches
  (daily-27888.cdiff) and for the full daily.cvd, with the proper
  FreshClam User-Agent.

Details

• cf-ray id (most recent, 2026-07-19): a1d976665b42be59-ZRH
• Additional cf-ray ids: a1b7604e4ab931a4-ZRH (2026-07-15),
  a1b6d799ffbdbc71-ZRH (2026-07-15)
• OS: Debian/Ubuntu (Plesk server)
• User-Agent: ClamAV/1.5.3 (OS: Linux, ARCH: x86_64, CPU: x86_64, UUID: 1765ffda-ce46-499b-90dd-f11eef14dc2b)

FreshClam output (excerpt)

[Dudedex]

Yes we run into the same issue and then getting locked out of further downloads

Self Hosted ClamAV 1.4.5

Error Message

Tue Jul 21 09:07:55 2026 -> ClamAV update process started at Tue Jul 21 09:07:55 2026
WARNING: Tue Jul 21 09:07:55 2026 -> FreshClam previously received error code 429 or 403 from the ClamAV Content Delivery Network (CDN).
Tue Jul 21 09:07:55 2026 -> This means that you have been rate limited or blocked by the CDN.
Tue Jul 21 09:07:55 2026 -> 1. Verify that you're running a supported ClamAV version.
Tue Jul 21 09:07:55 2026 -> See https://docs.clamav.net/faq/faq-eol.html for details.
Tue Jul 21 09:07:55 2026 -> 2. Run FreshClam no more than once an hour to check for updates.
Tue Jul 21 09:07:55 2026 -> FreshClam should check DNS first to see if an update is needed.
Tue Jul 21 09:07:55 2026 -> 3. If you have more than 10 hosts on your network attempting to download,
Tue Jul 21 09:07:55 2026 -> it is recommended that you set up a private mirror on your network using
Tue Jul 21 09:07:55 2026 -> cvdupdate (https://pypi.org/project/cvdupdate/) to save bandwidth on the
Tue Jul 21 09:07:55 2026 -> CDN and your own network.
Tue Jul 21 09:07:55 2026 -> 4. Please do not open a ticket asking for an exemption from the rate limit,
Tue Jul 21 09:07:55 2026 -> it will not be granted.
WARNING: Tue Jul 21 09:07:55 2026 -> You are still on cool-down until after: 2026-07-22 09:07:08
WARNING: Tue Jul 21 09:07:55 2026 -> Can't download sanesecurity.ftm from /sanesecurity.ftm
WARNING: Tue Jul 21 09:07:55 2026 -> FreshClam received error code 403 from the ClamAV Content Delivery Network (CDN).
Tue Jul 21 09:07:55 2026 -> This could mean several things:
Tue Jul 21 09:07:55 2026 -> 1. You are running an out-of-date version of ClamAV / FreshClam.
Tue Jul 21 09:07:55 2026 -> Ensure you are the most updated version by visiting https://www.clamav.net/downloads
Tue Jul 21 09:07:55 2026 -> 2. Your network is explicitly denied by the FreshClam CDN.
Tue Jul 21 09:07:55 2026 -> In order to rectify this please check that you are:
Tue Jul 21 09:07:55 2026 -> a. Running an up-to-date version of FreshClam
Tue Jul 21 09:07:55 2026 -> b. Running FreshClam no more than once an hour
Tue Jul 21 09:07:55 2026 -> c. If you have checked (a) and (b), please open a ticket at
Tue Jul 21 09:07:55 2026 -> Issues · Cisco-Talos/clamav
Tue Jul 21 09:07:55 2026 -> and we will investigate why your network is blocked.
WARNING: Tue Jul 21 09:07:55 2026 -> You are on cool-down until after: 2026-07-22 09:07:55
WARNING: Tue Jul 21 09:07:55 2026 -> fc_download_url_databases: fc_download_url_database failed: Forbidden; Blocked by CDN (17)
ERROR: Tue Jul 21 09:07:55 2026 -> Database update process failed: Forbidden; Blocked by CDN
ERROR: Tue Jul 21 09:07:55 2026 -> Update failed.

Happend on a single host, retried this morning to be sure we don't cause a rate limit error by ourself => directly locked for another 24hrs

[val-ms]

@Dudedex The log you shard is pointing at sanesecurity.ftm, which is a third party signature from https://sanesecurity.org/. You will have to remove that from your configuration or else ask sanesecurity for help with the 403 issue.

[val-ms]

@oreactko please share full failed update logs with the latest version, along with your public IP address, if you're able. I can then run it by our Cloudflare CDN account admin to check our logs and find out why the firewall rules are blocking you.

[val-ms]

@sueess86 I believe we've fixed the issue in your case. Please try again.

[sueess86]

@sueess86 I believe we've fixed the issue in your case. Please try again.

Yes, thank you. It is working now.