Open Information Security Foundation

10/29/2026

VJ 01:29 PM Suricata Bug #9327 (Resolved): docs/hashlib: documented *_hex_digest names do not exist (code registers *_hexdigest) (8.0.x backport)

Victor Julien

VJ 01:16 PM Suricata Bug #9223 (Resolved): detect: memory leaks in the alert output (8.0.x backport)

Victor Julien

10/22/2026

VJ 03:42 PM Suricata Bug #9262 (In Progress): http2: stream progress does not follow the header block's completion; firewall decisions at request_headers wait forever or decide early

h2. Description
The HTTP/2 stream progress follows the kind of the last frame, not the completion of the parts of the message. Any HEADERS frame without END_STREAM puts the stream in @request_headers@, and it stays there after END_HEA... Victor Julien

VJ 03:23 PM Suricata Bug #9232: SNI not evaluated for a second QUIC connection that reuses the UDP source port

Is this a duplicate of #8776 or is it a similar but different issue? Victor Julien

VJ 03:04 PM Suricata Bug #9224: firewall: payload keywords on a packet scoped hook aborts instead of rejecting the rule

It seems to me the rule should work, and not error out. But needs a bit more analysis. Victor Julien

VJ 08:49 AM Suricata Bug #9257 (In Progress): firewall: a rule without a fast pattern decides on incomplete data of the tx's current state

h2. Description
In firewall mode, a firewall rule without a fast pattern (for example only @http.host; pcre:"/good\.example/";@) decides on incomplete data of the transaction's current state.
While the transaction is at the rule's ... Victor Julien

VJ 08:33 AM Suricata Bug #9255 (In Progress): firewall: a contentless <hook accept:hook loses its accept on the next update

h2. Description
In firewall mode, a contentless "accept the hook and the states before it" rule (@accept:hook proto:<hook@ without content) only accepts its hook for the update in which it matches. Its match is not kept: when a later ... Victor Julien

10/19/2026

VJ 03:16 PM Suricata Bug #9224 (Assigned): firewall: payload keywords on a packet scoped hook aborts instead of rejecting the rule

@lukas.sismis can you also look at if this needs a backport? Victor Julien

10/06/2026

VJ 03:59 PM Suricata Bug #8944 (In Review): firewall: auto-accept-prior-states not honored when a same-hook drop rule leads the candidate list

Additional fixes https://github.com/OISF/suricata/pull/16392 Victor Julien

VJ 03:59 PM Suricata Bug #9149 (In Review): firewall: Performance regression for firewall mode as opposed to system mode

https://github.com/OISF/suricata/pull/16392 Victor Julien