Open Information Security Foundation

Today

LS 03:58 AM Suricata Bug #9399 (New): enip: cip_service does not match CIP requests with a symbolic path or inside an Unconnected Send

@cip_service@ only matches CIP requests whose path is made of logical segments. With Suricata 8.0.7 (and main at 4badfd1), these well-formed requests (one RegisterSession and one SendRRData or SendUnitData each) give:
|_. CIP request ... Lucas Sotomayor

11/06/2026

LS 11:44 PM Suricata Bug #9398 (New): rdp: X.224 Connection Request is logged when it is not the first PDU of the connection

Suricata 8.0.7 (the same code in master at 4badfd1, rust/src/rdp/rdp.rs @parse_ts@): the RDP parser creates an X224ConnectionRequest transaction (and logs the cookie) for any Connection Request in the to-server stream, also when other TP... Lucas Sotomayor

10/31/2026

LS 11:43 PM Suricata Task #3553: Tracking: enable GAP recovery for all TCP app-layer protocols

DNP3 and Modbus: gap recovery PRs are open, OISF/suricata#16553 (#3555) and #16552 (#3554). Lucas Sotomayor

LS 11:36 PM Suricata Feature #3555: DNP3: support GAP recovery

PR with gap recovery for DNP3: https://github.com/OISF/suricata/pull/16553. Suricata-Verify tests: https://github.com/OISF/suricata-verify/pull/3501. Lucas Sotomayor

LS 11:36 PM Suricata Feature #3554: modbus: support GAP recovery

PR with gap recovery for Modbus: https://github.com/OISF/suricata/pull/16552. Suricata-Verify tests: https://github.com/OISF/suricata-verify/pull/3502. Lucas Sotomayor

10/20/2026

LS 11:38 PM Suricata Feature #9205: dnp3: events for link-layer recovery, optional resync on bad start bytes

Update: the current PR is https://github.com/OISF/suricata/pull/16442, with tests in https://github.com/OISF/suricata-verify/pull/3467. Following review, the event described above as dnp3.policy_divergence is now dnp3.after_resync (same ... Lucas Sotomayor

10/11/2026

LS 08:18 PM Suricata Bug #9208 (New): modbus: "SURICATA Modbus Data mismatch" (sid 2250008) fires on every valid Read Holding/Input Registers response

*Affected version:* 8.0.7 (built from source, Linux). Current @main@ (4badfd1) has the same dependency (@sawp-modbus = "~0.13.1"@) and calls @matches()@ in the same way, so I expect it to be affected too; I have not run main.
h2. Summ... Lucas Sotomayor

10/10/2026

LS 02:29 PM Suricata Feature #9205 (In Review): dnp3: events for link-layer recovery, optional resync on bad start bytes

PR: https://github.com/OISF/suricata/pull/16420 Lucas Sotomayor

LS 02:04 PM Suricata Feature #9205 (In Review): dnp3: events for link-layer recovery, optional resync on bad start bytes

The DNP3 link-layer parser recovers from some link errors (since 8.0.7, a bad link CRC or an impossible LENGTH resynchronizes on the next start sequence) but not from others: octets that are not a start sequence are still a fatal parser ... Lucas Sotomayor