Memory-safe Rust engine
The scanning and extraction code is safe Rust (#![forbid(unsafe_code)]
in the core crates) — no C, no native JIT. Whole classes of CVE are ruled
out by construction rather than patched one at a time.
exav
A fast, memory-safe malware scanner written in Rust.
exav is a malware scanner written in memory-safe Rust: a single static
MIT-licensed binary that scans files of any size in constant memory and runs a
native YARA engine. It reads ClamAV’s signature databases, answers the clamd
and ICAP protocols, and takes clamscan’s command line — so it drops into an
existing ClamAV setup without changing anything around it.
Constant-memory streaming
Scans multi-GB files in a single forward pass — a 6 GiB file on a 4.8 GiB-RAM machine is detected, with a flat ~2 MiB per-scan working set regardless of file size. Formats that cannot be read forward-only (a ZIP’s directory is at its end) are buffered to a temp file first, under budgets you set.
Native YARA engine
Near-full YARA support via a native tree-walking evaluator — no runtime codegen at scan time, a lean pure-Rust dependency tree, on by default.
Drop-in compatible
Loads existing .cvd/.ndb/.ldb/.hdb/YARA signature databases and
answers the clamd protocol — so clamdscan, milters, and existing
tooling talk to exav unchanged.
Prebuilt `.exavdb`
Compile a large signature set once, then load it in seconds everywhere — a ~19× faster, ~5× lighter cold start.
WASM sandbox
The whole engine compiles to a WASI module, so you can load untrusted signatures without giving them host access — with zero custom host code.
Never a silent clean
exav’s core safety rule: never report a file clean unless it was fully
scanned. Anything that stops the scan early surfaces as a distinct
verdict — never absorbed into OK. A deployment can choose to deliver such
an object anyway, but only by saying so, and it is still reported.
MIT licensed
A single static binary under a permissive license, built clean-room from public specifications — nothing derived from GPL sources.
Start here
Section titled “Start here”Why exav existsWhat exav is, and the design principles it is built around.
InstallBuild from source, packages, containers, and the WASM module.
Quick startGet signatures, run your first scan, understand the output.
Design principlesMemory safety, no runtime codegen, constant-memory streaming, never a silent clean, and more.