LoginSign Up
← Back to all sparks
S

Snort 3

INFRA · APIS
Velocity5.0

Open-source intrusion prevention and detection system

www.snort.org ↗

Snort 3.13.2 is a broad bounds-checking sweep across SMB, HTTP and industrial protocol parsers

intrusion detectionmemory safetyprotocol parsinghttp inspectionapplication identification
◆Current state
Snort 3.13.2.0, released 5 November, is a large roll-up that mostly bounds and validates input: SMB header checks, a fix for an SMB inspection bypass via crafted keep-alive lengths, OLE2 VBA heap fixes, MMS and DNP3 length limits, and a heap out-of-bounds write in the Unix transport. It also adds new http_inspect alerts for malformed or oversized headers, file cache control commands, and appid support for MCP inspector verdicts. The 3.13 line requires the Talos LightSPD rules package from 14 September onward because of an API bump in 3.13.0.0.
◆Where it's heading
Memory safety and input bounding now dominate every release, with feature work limited to new alerts and operator controls. The appid line about MCP inspector verdicts is the one hint that Snort is starting to classify AI agent traffic, though the entry gives no detail.
◆Prediction
Expect more parser hardening in 3.13.3 and a 3.12.x maintenance release alongside it; whether MCP inspection becomes a documented feature is unclear from these entries.

◆Recent moves

  1. 4d ago

    Snort v3.13.2.0

    Dozens of bounds checks and overflow fixes, including an SMB inspection bypass, plus new http_inspect alerts for malformed and oversized headers. It continues the systematic hardening pattern, with a single appid line on MCP inspector verdicts as the only new direction.

    View source ↗
  2. 19d ago

    3.12.4.0: IDS reject fix, parser bounds, detection tuning

    A large roll-up that corrects reject and react behavior in IDS mode and bounds several unbounded paths in DNS, decompression and SMB handling. It continues the memory-safety campaign and adds detection hot-path tuning.

    View source ↗
  3. 1mo ago

    Snort 3.13.1.0 tagged

    A build-tag entry with no notes of its own; its changes appear in the 3.13.2.0 roll-up, which lists fixes since 3.13.1.0.

    View source ↗
  4. 2mo ago

    Snort 3.13.0.0 opens a new line with a rules API bump

    The entry itself is only a build tag, but later notes show 3.13.0.0 bumped the rules API, requiring Talos LightSPD packages from 14 September onward. That makes it the start of the current release line rather than a routine patch.

    View source ↗
  5. 2mo ago

    Snort 3.12.5.0 maintenance tag

    A build-tag entry for the 3.12 maintenance line with no listed changes, released days before 3.13.0.0.

    View source ↗
  6. 6mo ago

    3.12.2.0: deviceinfo Lua API and dce_rpc memory fixes

    Adds a Lua API for publishing deviceinfo events and two-way SSL cache data, on top of a long list of dce_rpc and dce_smb memory-leak and use-after-free fixes. The detector-facing Lua surface keeps growing while the C internals get cleaned.

    View source ↗