Open Information Security Foundation

10/04/2026

VJ 05:54 AM Suricata Bug #9149 (In Progress): firewall: Performance regression for firewall mode as opposed to system mode

The main issue has been the missing MPM support for LTE rules to reduce complexity of the work. Now that non-MPM LTE rules are more of less settled, I'll look at adding the prefilter/MPM support. Victor Julien

VJ 05:51 AM Suricata Bug #9047 (Resolved): tls: rewrite tx state machine

Resolved by https://github.com/OISF/suricata/pull/16362 Victor Julien

VJ 05:51 AM Suricata Bug #9046 (Resolved): ssh: clean up tx state machine

Resolved by https://github.com/OISF/suricata/pull/16362 Victor Julien

VJ 05:50 AM Suricata Bug #8944 (Resolved): firewall: auto-accept-prior-states not honored when a same-hook drop rule leads the candidate list

Resolved by https://github.com/OISF/suricata/pull/16362 Victor Julien

10/03/2026

VJ 07:06 AM Suricata Feature #9151: detect: Add option to disable tag tracking

IIRC tags can only be set by rules, so we could also auto-detect that no tags are in use and skip the check? Possibly a per detect engine flag of sorts? Guess that could leave edge cases around reloads adding/removing tags. An other way ... Victor Julien

10/01/2026

VJ 09:45 AM Suricata Bug #9146 (In Review): flow/timeout: race condition in flow timeout handling causing missing logs

https://github.com/OISF/suricata/pull/16349 Victor Julien

VJ 07:46 AM Suricata Bug #9146 (In Review): flow/timeout: race condition in flow timeout handling causing missing logs

Observed in flaky tests in CI: @smb2-ntlmssp-negotiateflags@, @http-sticky-server@ both sometimes failed with missing logs. Victor Julien

09/29/2026

VJ 08:22 PM Suricata Bug #9141 (In Review): IPS: long-lived TLS flow dropped with "applayer error" (tls.gap) at exactly 2^32 + 2^31 + stream.reassembly.depth bytes

https://github.com/OISF/suricata/pull/16334 Victor Julien

VJ 10:54 AM Suricata Bug #9116 (In Review): detect: memory leaks in the alert output

Considering regular bug.
https://github.com/OISF/suricata/pull/16329 Victor Julien

VJ 10:01 AM Suricata Security #9125 (In Review): vlan: PacketReinit() leaves vlan_id[2] stale on packet-pool recycle, splitting flows and enabling multi-segment rule evasion

https://github.com/OISF/suricata/pull/16328 Victor Julien