Suricata

With the attached pcap generating the smtp events and enabled the url extraction results in faulty outputs for the "url" section. This was fine in Suricata 7 but is "broken" since Suricata 8 and still in current 9 branch.

{
  "timestamp": "2023-09-26T01:11:30.259755+0200",
  "flow_id": 378993993464018,
  "pcap_cnt": 55,
  "event_type": "smtp",
  "src_ip": "10.10.25.101",
  "src_port": 49815,
  "dest_ip": "173.254.28.237",
  "dest_port": 587,
  "proto": "TCP",
  "ip_v": 4,
  "pkt_src": "wire/pcap",
  "tx_id": 0,
  "smtp": {
    "helo": "SANDERS-DESKTOP",
    "mail_from": "<oppong@expertsconsultgh.co>",
    "rcpt_to": [
      "<info@ledcenter.by>" 
    ]
  },
  "email": {
    "from": "oppong@expertsconsultgh.co",
    "to": [
      "info@ledcenter.by" 
    ],
    "status": "PARSE_DONE",
    "url": [
      "https://o=\r\n",
      "https://linkedin.com/",
      "https://faceboo=\r\n",
      "https://amazon.com/" 
    ]
  }
}

This is how the part looked in 7

  ],
  "url": [
    "https://outlook.com/",
    "https://linkedin.com/",
    "https://facebook.com/",
    "https://amazon.com/" 
  ]
}

And this is the wireshark extraction:

Simple Mail Transfer Protocol
    Line-based text data (22 lines)
        Time: 09/25/2023 23:11:29<br>User Name: leon.r.sanders<br>Compute=\r\n
        r Name: SANDERS-DESKTOP<br>OSFullName: Microsoft Windows 11 Pro<b=\r\n
        r>CPU: Intel(R) Core(TM) i5-13600K CPU @ 5.30GHz<br>RAM: 8191.05 =\r\n
        MB<br>IP Address: 173.66.46.112<br><hr>Host: https://amazon.com/<=\r\n
        br>Username: 1687707994<br>Password: C^+QZp)Z5]U-Bw8_S&$5(GdH=3Dw=\r\n
        B;uA#!<br>Application: Edge Chromium<br><hr>Host: https://faceboo=\r\n
        k.com/<br>Username: 1687707994<br>Password: P+U_6BjqdbbZ(t!Dq#7s<=\r\n
        br>Application: Edge Chromium<br><hr>Host: https://linkedin.com/<=\r\n
        br>Username: leon.r.sanders@outlook.com<br>Password: pv9g_6Pm=3DY=\r\n
        5V-bnW`V2!Kr<br>Application: Edge Chromium<br><hr>Host: https://o=\r\n
        utlook.com/<br>Username: leon.r.sanders@outlook.com<br>Password: =\r\n
        NC9_R!j2-zzj+vrtSv$qYuX=3Dx9<br>Application: Edge Chromium<br><hr=\r\n
        >Host: LegacyGeneric:target=3DWindowsLive:(token):name=3Dleon.r.s=\r\n
        anders@outlook.com;serviceuri=3Daccount.live.com=00<br>Username: =\r\n
        leon.r.sanders@outlook.com=00<br>Password: <br>Application: Windo=\r\n
        ws Credential<br><hr>Host: LegacyGeneric:target=3DMicrosoftAccoun=\r\n
        t:user=3Dleon.r.sanders@outlook.com=00<br>Username: leon.r.sander=\r\n
        s@outlook.com=00<br>Password: <br>Application: Windows Credential=\r\n
        <br><hr>Host: WindowsLive:target=3Dvirtualapp/didlogical=00<br>Us=\r\n
        ername: 02rkfxyvuqfgdcei=00<br>Password: <br>Application: Windows=\r\n
         Credential<br><hr>Host: LegacyGeneric:target=3DOneDrive Cached C=\r\n
        redential=00<br>Username: 823624

The current guess is, that it's related to the switch to the rust mime parser