| Version | 5.17.0 |
|---|---|
| Release date | 16 December 2025 |
| Scope | This major version introduces a new technology OPSWAT Alin, revamped Processing Result interface, Certificates storage, new support on Split Archive processing and several further enhancements. |
Making sure to check out the Known Limitations
New Features, Improvements and Enhancements
Brand New Technology: OPSWAT Alin
MetaDefender Core introduces a brand new technology called OPSWAT Alin that works alongside Metascan to improve threat detection depth and accuracy.
The new technology analyzes file structures, entropy patterns and semantic relationships using a domain-trained machine learning model to identify potentially harmful files earlier and with greater precision.
Revamped Processing Result Interface
As you can see above, our processing result interface has been redesigned to deliver clearer, more actionable insights, making it easier for administrators and support teams to interpret scan outcomes and take appropriate action.
We have also made it easier for users to know original file type and Deep CDR's converted destination type directly on the processing result screen.
Unified User Interface and Experience of Login and Guest Scan Screens
Login and Guest Scan screens have been unified across MetaDefender platform, bringing the similar feeling for customers of the platform.
Certificate Management Enhancements
Certificate management now allows administrators to upload certificates directly by content, simplifying secure configuration and compliance. You can now add or update certificates by directly uploading certificate content.
Support Package Enhancements
Support packages now include additional log types and process IDs, enabling users to select specific logs and set a maximum log size prior to generating.
Email Notification Enhancement
Email notifications have been improved to support batch aggregation and clearer messaging. This improves reporting efficiency for large-scale processing.
Support for Split Archive Files
MetaDefender Core now supports comprehensive scanning Split Archive file type.
The product accepts individual requests with split-archive parts sent via a new set of API endpoints, reassemble them, then extract and process nested files. Integration instruction at Split archive upload guideline.
Further Enhancements
1) A new synchronization interval setting for My OPSWAT Central Management integration provides greater control over data sync timing.
2) When you create a new workflow rule with Deep CDR enabled, all file types will be activated by default. Note: HTML and TXT, which are reserved for email-specific use cases, will stay unselected.
3) The product now supports teamed NIC (Network Interface Card) configurations, preserving Deployment ID and maintaining stable license activation when network adapters are changed or switched within the team.
4) The response of POST - LoginAPI now will return the header X-Core-Id if custom header is configured. It will help the customers identify which instance behind load balancer users login to.
5) Introduce new metrics regarding disk IO percentage in GET /stat/nodesAPI API, providing better visibility into node performance and potential bottlenecks. Adding disk_stat_info :
- Disk utilization (%): Min-Max value from 0 to 100
- Read speed (Mb/s): Min 0, Max depend on disk
- Write speed (Mb/s): Min 0, Max depend on disk
6) Filtering and exporting processing history is now enhanced with file size and extraction issue filters, allowing users to quickly locate large or small files processed by the system and troubleshoot archive processing events.
7) Roll out a major enhancement for HotSwap-type MetaDefender Core deployments. Now, both local and My OPSWAT Central Management environments handle backup licenses with accurate engine lists, clear status reporting, and smooth configuration management.
Security Enhancements
1) Upgraded libraries for vulnerability fixes:
- Qt v6.8.1
- PostgreSQL v14.20
2) Implements rate limiting on database connection test and save endpoints to mitigate brute-force and abuse risks.
3) Add more length validations for text components in Workflow/Global Configuration to strengthen security and consistency.
4) Update the PDF export process to ensure hyperlinks are rendered as plain text, preventing accidental clicks.
5) Tightening up security for exporting Sandbox JSON and SBOM reports. Previously, it was possible to export these reports without providing a valid and authorized API key. Now, the system strictly validates user permissions and denies unauthorized access.
6) Enhance the validation on SSL certificates for HTTPS connections by rejecting mismatched cert & key, incorrect format, encrypted private key (if no passphrase provided).
Bug Fixes
- Fixed an issue where value of others_time may be negative when processing encrypted document files.
- Applied consistent name validation rules when updating workflows.
- Resolved issues with resetting global configuration for Adaptive Sandbox.
- Corrected a permissions issue where users without full module rights could modify engine configurations.
- Fixed an issue where AV engines would reappear in scan results after Metascan SDK deletion.
- Fixed an issue where AV engines of Metascan SDK could not be fully deleted and cause orphaned subprocesses after removing its database.
- Fixed an issue preventing configuration changes or AV removal when both Metascan SDK and traditional AVs were installed.
- Fixed an issue where files were retained if a download was aborted.
- Improved the accuracy of warning messages when users input invalid API keys.
- Fixed an issue where files in quarantine could not be scanned by Adaptive Sandbox, caused by missing data in the quarantine process.
- Fixed an issue where the password reset email would truncate passwords containing the '<' character.
- Other cosmetic fixes.
Known Limitations
| Slow or Inaccessible Management Console | This issue has been resolved in version 5.13.2 In version 5.12.0, an issue was identified that caused some APIs to load more slowly than expected. As a result, the Web Management Console might experience slower performance or become unresponsive Please read more details on this page: Slow or Inaccessible Management Console. |
| The 'Proxy server requires password' setting cannot be disabled once it has been enabled | This issue has been resolved in version 5.14.2. In version 5.14.1, there was an issue that prevented disabling the |
| Database connection failure occurred in a specific circumstance after upgrading to version 5.11.0 | This issue has been resolved in version 5.11.1. This issue does not affect all cases when upgrading to version 5.11.0. After applying the authentication method
We prepare a Knowledge Base (KB) for troubleshooting the issue and bringing the system back online: How to troubleshoot an error related to connection to database failing after an upgrade to v5.11.0? The issue will not occur in the following scenarios:
|
| Archive compression may fail with very large archive files that contain a large number of subfiles | This issue has been addressed in version 5.14.0. MetaDefender Core has a limitation when compressing very large archive files that contain a high number of subfiles. In our test scenario, it failed when processing an archive with 300,000 or more subfiles. |
| Reuse processing result by hash might be slow in high-load situations | This issue has been resolved in version 5.10.1. Since its introduction in version 5.8.0, this feature has helped improve overall performance and reduce significant load when processing similar files. However, we have realized this feature might run slowly in high-load scenarios against large database sizes. |
| Temporary files in the resource folder may not be properly cleaned up if the Archive Extraction engine crashes | Starting from MetaDefender Core version 5.10.1, if the Archive Extraction engine crashes, temporary files from specific extraction transactions may not be properly cleaned up. However, this issue is relatively rare. |
| Reject importing non-empty required_engines setting in containerized environments | This issue occurs only in containerized environments. If the config zip file includes non-empty required_engines setting, MetaDefender Core will reject the import. Workaround:
|
| The Engine Update feature may not work as expected in certain environments | We have observed that the Engine Update feature may not work properly in an environment protected by a Palo Alto firewall. In the log file, you might find the error message ' If upgrading to the latest version of MetaDefender Core does not solve the issue, please consider setting up MetaDefender Update Downloader product. This product is responsible for downloading engines, and MetaDefender Core will retrieve and update its engines from there. |
| Stability issues on Red Hat / CentOS systems with kernel version 372.13 | MetaDefender Core version 5.2.1 or later may not function correctly with Red Hat or CentOS operating systems that use kernel 372.13. Red Hat is addressing the kernel issues. Please try upgrading to kernel version 372.26. |
| PostgreSQL and MetaDefender Core services cannot initialize in certain containerized environments | This issue was addressed in version 5.11.1. In a containerized environment, MetaDefender Core version 5.2.0 or newer may work properly when:
Workarounds for older versions:
|
| MetaDefender Core's NGINX web server will not start if weak cipher suites are used for HTTPS | On MetaDefender Core version 5.2.0 and later, OpenSSL 1.x has been replaced by OpenSSL 3.x within the product and its dependencies, including PostgreSQL and NGINX, to enhance security and address known vulnerabilities in OpenSSL 1.x. However, NGINX's implementation of OpenSSL 3.x in MetaDefender Core enforces strong encryption by rejecting all weak cipher suites. It only accepts "HIGH" encryption cipher suites as defined by OpenSSL https://www.openssl.org/docs/man1.1.1/man1/ciphers.html. This means ciphers based on MD5 and SHA1 hashing are no longer supported. Consequently, if you previously configured MetaDefender Core for HTTPS connections using a weak SSL cipher with your certificate, the service will not start due to NGINX's OpenSSL 3.x security enforcement. To prevent and remediate the issue before upgrading MetaDefender Core, please refer to the following resources: HTTPS Failure on MetaDefender Core 5.2.0 (or newer). |
| TCP socket port exhaustion may cause the service trouble, preventing from restarting, and Workflow configuration corrupted | This issue affected MetaDefender Core (MD Core) version 5.15.0 and earlier and is enhanced starting from version 5.15.1. TCP socket port exhaustion might be triggered by other applications; for example, MetaDefender KIOSK v4.7.6.3514 (fixed in later releases). Consequently, MD Core may behave abnormally, corrupt its Workflow Configuration, and fail to restart. |
