suricata: Update to 8.0.7

For details see:
https://redmine.openinfosecfoundation.org/versions/236

Excerpt from changelog:

"8.0.7 -- 2026-09-13

Security #9002: lua/hashlib: use after free when using gc (8.0.x backport)
Security #8881: lua/hashlib: null dereference attempting to use hash after finalize call (8.0.x backport)
Security #8801: ike: memory exhaustion from unbounded recursion (8.0.x backport)
Security #8982: dnp3: link-layer events before first transaction are dropped (8.0.x backport)
Security #8938: dhcp: detection bypass parsing DHCP Pad option (code 0) (8.0.x backport)
Security #8922: detect/inspect: infinite loop with too large response-body-limit and stream.reassembly.depth (8.0.x backport)
Security #8971: pgsql: detection bypass post gap recovery (8.0.x backport)
Security #8870: htp: unbounded memory exhaustion in logging (8.0.x backport)
Security #8769: datasets: buffer overread with too small hashes (8.0.x backport)
Security #8930: detect: heap OOB read on byte_test with nbytes from byte_extract/byte_math (8.0.x backport)
Security #8909: ftp: global memuse counter leak (8.0.x backport)
Security #8986: rdp: detection bypass due to infinite loop in MCS/CS processing T.123 TPKT payload (8.0.x backport)
Security #8947: htp: detection bypass of files due to mishandling of FHCRC field by gzip decompressor (8.0.x backport)
Security #9000: jsonbuilder: exposed endpoints for JSON injection (8.0.x backport)
Security #8981: dnp3: framing errors stop transaction inspection for the flow (8.0.x backport)
Security #8732: rfb: too long strings can cause log flooding (8.0.x backport)
Security #8877: dnp3: DoS via huge fixed-size object structs like G70Vx/G120Vx (8.0.x backport)
Security #8794: ldap: unbounded recursion in ldap-parser crate (8.0.x backport)
Security #8937: tls: detection bypass due to X.509 SubjectAltName count truncation (8.0.x backport)
Security #8921: pcap/log: heap out-of-bounds read with oversized TCP packets (8.0.x backport)
Security #8965: http2: Host-only requests bypass host inspection and inline policy (8.0.x backport)
Security #8810: enip: parser bypass with tcp data splicing (8.0.x backport)
Security #8758: enip: quadratic complexity in parse_cip_reqresp_multiple (8.0.x backport)
Security #8985: swf: excessive memory allocation from attacker controlled traffic (8.0.x backport)
Security #8927: ssl: integer underflow due to miscalculation in SSLv2 CLIENT_HELLO (8.0.x backport)
Security #8906: lua: type mismatch crashes Suricata (8.0.x backport)
Security #8998: defrag: fragments bypass the layer limit and exhaust the worker stack (8.0.x backport)
Security #8946: http2: parser desync on HEADERS frame without END_HEADERS flag (8.0.x backport)
Security #8977: ike: detection bypass in case of invalid major version in header (8.0.x backport)
Security #8677: pgsql: unbounded backend responses (8.0.x backport)
Security #9009: http: brotli compression bomb (8.0.x backport)
Security #8875: defrag/ipv6: detection bypass due to integer overflow (8.0.x backport)
Security #8792: nfs: unbounded read/write data queuing (8.0.x backport)
Security #8933: detect: heap OOB read on byte_test with nbytes from a runtime variable (8.0.x backport)
Security #8920: doh: dns inspection uses the wrong transaction for progress (8.0.x backport)
Security #8963: http2: IPv6 authority truncation bypasses normalized host policy (8.0.x backport)
Security #8984: detect/file: detection bypass with multiple file keywords on a transaction (8.0.x backport)
Security #8808: lua/datasets: heap OOB due to improper string length handling (8.0.x backport)
Security #8756: http2: unbounded dynamic table growith with header size update (8.0.x backport)
Security #8989: pgsql: row_description/consolidated_data_row never reconciled against msg length (8.0.x backport)
Security #8925: lua/flowvar: heap buffer overflow with unverified length (8.0.x backport)
Security #8898: lua/dns: heap buffer overflow due to unbounded Lua stack (8.0.x backport)
Security #8945: flow: ESP SPI omission from flow hash  (8.0.x backport)
Security #9005: swf: unlimited decompress-depth leads to detection bypass due to truncated buffer (8.0.x backport)
Security #8872: smtp: NULL pointer deref on MIME processing if internal file malloc fails (8.0.x backport)
Security #8790: smb1: unbounded read/write data queuing (8.0.x backport)
Security #8932: output: remote DoS with tcp-data/http-body-data in case of file handling errors (8.0.x backport)
Security #8913: detect/tx: heap buffer overflow with post-rule-match prefilter (8.0.x backport)
Security #8957: threshold: decision cache can grow without bound and terminate Suricata (8.0.x backport)
Security #8746: lua/smtp: infinite loop in get_mime_list (8.0.x backport)
Security #8988: ftp: lines following an over-long command or reply in the same stream slice are never parsed (8.0.x backport)
Security #8983: stream: inspection bypass due to erroneous wiping of TCP session flags (8.0.x backport)
Security #8806: lua: sandbox memory limit bypass (8.0.x backport)
Security #8751: nfs: v3 READ attr_follows=0 file-data inspection bypass (8.0.x backport)
Security #8924: nfs: detection bypass due to incorrect handling of SECINFO_NO_NAME (8.0.x backport)
Security #8883: dns: detection bypass at resync post gap (8.0.x backport)
Security #9004: detect/http2: use after free with http.request_header keyword (8.0.x backport)
Security #9013: pgsql: JSON corruption with crafted malicious traffic (8.0.x backport)
Security #8972: pgsql: unbound Copy Responses lead to parser desync (8.0.x backport)
Security #8941: mqtt: memory exhaustion due to unbounded unknown property parsing (8.0.x backport)
Security #8871: detect: abrupt termination if a pcre flowvar capture matches on a packet with no flow (8.0.x backport)
Security #8788: http2: header detection bypass due to wrong padding handling (8.0.x backport)
Security #8931: datasets: bypass of save/state paths sandbox on Windows (8.0.x backport)
Security #8910: ftp: invalid command buffer after long line truncation (8.0.x backport)
Security #8974: detect: DoS due to type confused free upgrading protocols http1 to http2 to doh2 (8.0.x backport)
Security #8950: ldap: detection bypass at resync post gap (8.0.x backport)
Security #8987: ssh: miscalculation due to oversized KEXINIT causes parser desync (8.0.x backport)
Bug #9035: sip: protocol detection incorrectly matches ssdp traffic (8.0.x backport)
Bug #9033: threads: fix pthread attribute leak in TmThreadSpawn (8.0.x backport)
Bug #9024: pgsql: use message type for transaction actions (8.0.x backport)
Bug #9018: output: Double-free of prefix/sensor_name in threaded LogFileCtx teardown (8.0.x backport)
Bug #9017: erf/file: ERF PAD and META type records and extension headers are not supported (8.0.x backport)
Bug #9016: erf/file: sets packet length from unvalidated wlen, causing OOB heap read in decoder (8.0.x backport)
Bug #9015: erf/file: Heap buffer overflow in ERF file reader via untrusted rlen field (8.0.x backport)
Bug #9014: util: undefined behavior in fallback memrchr implementation (8.0.x backport)
Bug #9011: detect: NULL deref in alert output when reference keyword uses undefined key (8.0.x backport)
Bug #8996: smtp: rejected BDAT reply leaves parser in data mode (8.0.x backport)
Bug #8976: unwind: OOB write in case of deep call stack (8.0.x backport)
Bug #8955: firewall: action scope not validated when inherited in multi-action rules (8.0.x backport)
Bug #8952: engine-analysis: packet:filter policy is hardcoded to drop:packet (8.0.x backport)
Bug #8942: setting variables with --set leads to segfault (8.0.x backport)
Bug #8936: dhcp: parser never reports malformed options (8.0.x backport)
Bug #8935: dhcp: parser ignores the declared length of time options (8.0.x backport)
Bug #8934: nfs: large attacker-controlled memory allocation parsing NFSv4 LAYOUTGET reply (8.0.x backport)
Bug #8929: reject: DoS by non-Ethernet capture packet in autofp mode due to stale context caching (8.0.x backport)
Bug #8928: smb1: unbounded vector growth in NEGOTIATE dialect list (8.0.x backport)
Bug #8926: tls: use-after-free of JA3 elliptic-curve buffers on malloc failure (8.0.x backport)
Bug #8923: stream: SIGSEGV in SYN queue rotation helper (8.0.x backport)
Bug #8912: frame: incorrect debug assertion triggered (8.0.x backport)
Bug #8911: flow/rate: underflow due to incorrect flushing of the ring (8.0.x backport)
Bug #8902: detect: undefined behavior on OOB rvalue with byte_math (8.0.x backport)
Bug #8901: detect/iponly: detection bypass with ipv6 ranges (8.0.x backport)
Bug #8876: smtp: complete BDAT transactions at LAST (8.0.x backport)
Bug #8869: ippair: Memory leak caused by ippair processing (8.0.x backport)
Bug #8868: expectations: IPPair mutex/reference leak on malloc failure (8.0.x backport)
Bug #8804: dag: Infinite loop in DAG record processing when rlen < dag_record_size (8.0.x backport)
Bug #8796: tls: incorrect looping logic leads to extensions pollution (8.0.x backport)
Bug #8773: defrag: memuse reported incorrectly (8.0.x backport)
Bug #8765: smtp: assertion on DATA reply without owning transaction (8.0.x backport)
Bug #8761: http2: content-encoding are case insensitive (8.0.x backport)
Bug #8730: smtp: trailing quit can create an empty transaction (8.0.x backport)
Bug #8716: smtp: subsequent helo/ehlo should be treated like a rset (8.0.x backport)
Bug #8706: util/file: fix integer overflow in file inspection window comparison (8.0.x backport)
Bug #8705: af-packet: eBPF map location error never printed (8.0.x backport)
Bug #8618: threshold: seed only partially applied in IPv6 hash (8.0.x backport)
Bug #8474: flow: bypass manager checks for initializer instead of actual fn (8.0.x backport)
Bug #8314: firewall: rule language can't accept ARP (8.0.x)
Optimization #8786: mqtt: eve json corruption by crafted traffic (8.0.x backport)
Feature #9019: firewall: allow single packet rule to accept tcp connection (8.0.x backport)
Feature #8904: firewall: support SMTP hook states for firewall rule evaluation (8.0.x backport)
Feature #8879: datasets: add support for subdomain match (8.0.x backport)
Feature #8770: firewall: add default app policy options (8.0.x backport)
Feature #8729: firewall: allow single rule to accept protocol detection in progress and the final protocol (8.0.x backport)
Task #8688: psl: crate should be updated on every release (8.0.x backport)
Documentation #8345: doc: update Rust install instructions (8.0.x backport)"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
---
 lfs/suricata | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)