[PATCH 2/4] dnp3: reduce flood threshold to 32 and make configurable
authorJason Ish <jason.ish@oisf.net>
Tue, 6 Jan 2026 17:06:40 +0000 (11:06 -0600)
committerAndreas Dolp <dev@andreas-dolp.de>
Thu, 23 Apr 2026 05:14:21 +0000 (07:14 +0200)
commit889f97c73bb9691a2b28e8d4d380bf3e4798ba48
treea569d81c134c58a036fa3c1667791add0e11f972
parent4a6626fd3e4021a67ea670965e3b954b61331c8d
[PATCH 2/4] dnp3: reduce flood threshold to 32 and make configurable

Lower the number of unreplied requests from 500 to 32 to consider a
flood. At the very least this is an anomaly given the DNP3 spec mentions
that DNP3 should only have one outstanding request at a time, with an
exception for unsolicited responses, so in practice no more than 2
should be seen.

Additionally make this value configurable by introducing the max-tx
parameter.

Ticket: #8181
(cherry picked from commit a16f087b93be1ff2f2edf47371866ad9b28593c1)

Origin: upstream, https://github.com/OISF/suricata/commit/635af8dc8be09667689be71d781912718ca1aa49.patch
Bug: https://redmine.openinfosecfoundation.org/issues/8181
Subject: Upstream fix for CVE-2026-22259 part 2

Gbp-Pq: Name CVE-2026-22259_2.patch
doc/userguide/upgrade.rst
src/app-layer-dnp3.c
suricata.yaml.in