End-of-Life Announcement for Open-Source Snort2 and Strategic Security Updates for Snort3

Today we are announcing lifecycle updates regarding open-source Snort2, along with development updates and details on upcoming releases for open-source Snort3.

 

Open-Source Snort2 Lifecycle and Talos Engagement

All versions of the open-source Snort2 engine have now formally reached its end-of-life (EOL) and end-of-support (EOS). Consequently, active development, maintenance releases, and software package updates for the entire open-source Snort2 codebase (including Snort 2.9.20) have fully concluded.

In conjunction with the engine reaching EOL, Cisco Talos will no longer provide rule support or vulnerability detections for any open-source Snort2 version. Users operating legacy open-source Snort2 deployments should prioritize a migration plan immediately, as continuing to use the legacy engine leaves your environment exposed to emerging threats that are no longer addressed by security updates. Historical open-source Snort2 software packages and documentation will remain accessible on snort.org as reference archives.

 

Open-Source Snort3 Development and Upcoming Releases

Over the past several months, we have been focused on comprehensive security reviews and codebase hardening across open-source Snort3. This initiative included extensive static analysis, fuzz testing of protocol inspectors, and remediation of vulnerability reports identified through automated and LLM-assisted analysis tools to ensure robust engine stability and parser resilience.

The next major open-source release, Snort 3.12.4.0, is now available and bundles all recent security hardening improvements, defect fixes, and performance updates. See the corresponding Cisco PSIRT advisory for more details.

Although we had temporarily paused further release publication while completing this work, significant active development has continued, so keep an eye out for additional releases that will be posted in the coming weeks.

 

Resources for Open-Source Snort3

For teams and practitioners interested in evaluating Snort3 or exploring a transition from legacy configurations, comprehensive documentation and tools are readily available on snort.org. You can access the latest source and build guides or use the snort2lua utility to translate existing configuration files and rules directly into Snort3 syntax. Our community Discord, mailing lists, and GitHub repositories are always open for discussions and technical exchange.

End of Life Announcement for versions of Snort 2 AND Snort 3

Multiple versions of Snort 2 and Snort 3 have reached End of Life and we will no longer publish Snort Talos Rules for these versions as of today.

As of Today we will no longer be supporting the following versions of Snort Talos Rules

Snort 2

2.9.11.1

2.9.13.0

2.9.14.1

2.9.15.1

2.9.16.0

2.9.16.1

2.9.17.0
2.9.19.0

Snort 3

3.0.3.1

3.0.3.4

3.1.0.0

3.1.3.0

3.1.4.0

3.1.5.0

3.1.7.0

3.1.9.0

We encourage All Snort 3 users to use the Talos lightSPD rules package for downloading rules as this singular package contains configurations for every version of Snort 3 and Shared Object rules for all supported versions and architectures, in addition to the latest versions of all rules

Upgrade to the latest version of Snort 3 available here: https://snort.org/downloads 

For more information on the features and advantages of Snort 3 please visit:
https://snort.org/snort3 

For More information on using the Talos lightSPD package please visit:
https://blog.snort.org/2020/12/soft-release-lightspd-new-rules-package.html

For help downloading, installing and configuring Snort 3 please visit:
https://docs.snort.org/rules/

To take advantage of SnortML:
https://blog.snort.org/2024/08/watch-snortml-training-video.html 

To learn more about Snort 3 and Wide String Detection:
https://blog.snort.org/2025/04/in-snort-3.html 

For users who would like to continue to use Snort 2, we encourage you to update to Snort 2.9.20 as soon as possible, which can be found at https://snort.org/downloads . 

Snort 2.9.20 is the version of Snort that we will continue to support for the longest period of time. 

If you have any questions, please feel free to reach out to us at: snort-sub@cisco.com  or join our discord: https://discord.gg/DZpdZDJtSH

End of Life Announcement for Multiple Versions of Snort 2 and Snort 3

Multiple versions of Snort 2 and Snort 3 will be reaching End of Life this year.

As of 12/18/2025 the following versions of Snort 2 will have reached end of life and we will no longer publish Snort Talos Rules for these versions as a result, the following versions of Snort 2 will no longer be supported: 

2.9.11.1
2.9.13.0
2.9.14.1
2.9.15.1
2.9.16.0
2.9.16.1
2.9.17.0
2.9.18.1
2.9.19.0 

As of 12/18/2025, all versions of Snort 3 prior to and including Snort 3.1.9.0 will reach end of life and will no longer be supported.  

We encourage All Snort 3 users to use the Talos lightSPD rules package for downloading rules as this singular package contains configurations for every version of Snort 3 and Shared Object rules for all supported versions and architectures, in addition to the latest versions of all rules

Upgrade to the latest version of Snort 3 available here: https://snort.org/downloads 

For more information on the features and advantages of Snort 3 please visit:
https://snort.org/snort3 

For More information on using the Talos lightSPD package please visit:
https://blog.snort.org/2020/12/soft-release-lightspd-new-rules-package.html

For help downloading, installing and configuring Snort 3 please visit:
https://docs.snort.org/rules/

To take advantage of SnortML:
https://blog.snort.org/2024/08/watch-snortml-training-video.html 

To learn more about Snort 3 and Wide String Detection:
https://blog.snort.org/2025/04/in-snort-3.html 

For users who would like to continue to use Snort 2, we encourage you to update to Snort 2.9.20 as soon as possible, which can be found at https://snort.org/downloads . 

Snort 2.9.20 is the version of Snort that we will continue to support for the longest period of time. 

If you have any questions, please feel free to reach out to us at: snort-sub@cisco.com  or join our discord: https://discord.gg/DZpdZDJtSH

Official EOL Notice for 2.9.15.0 and 2.9.16.0

Attention Snort User and Integrators:

This blog post serves as your official 90-day notice that we will be EOL'ing rule support for versions 2.9.15.0 and 2.9.16.0 as of 2021-06-27 or June 27, 2021.

As we release new versions of Snort, occasionally we have to decommission older versions, lowering our amount of maintenance to build the ruleset for these different versions.  We continually review the usage of versions, and try to strive to only keep the most actively used versions around.  There are several older Snort rule integrators that are using very old versions (2.9.8.3 for example), which is the reason those versions are still around.  However, we are actively working with these partners to move them to more current versions of Snort.

If you are using an older version of Snort, we encourage you to please start your upgrades to 2.9.17.1 or Snort 3.

Our next versions to EOL will be 2.9.16.1, 2.9.11.1, and 2.9.14.1, so we encourage users of those versions to start your upgrade planning now.

Snort version EOL update

As a reminder, we are preparing to EOL the following versions of Snort rules on Dec. 18:

• 2.9.9.0
• 2.9.12.0

We had originally intended to EOL version Snort 2.9.11.1 as well. However, there are external third-party vendors that are on 2.9.11.1, and because of their development cycle, can't upgrade just yet, so it's going to hang around while our third-party ecosystem is given a chance to upgrade.

We are also planning on releasing bug fix 2.9.15.1 (tentatively) on Dec. 19, followed by a larger release of 2.9.16.0 in April 2020 (tentatively).

We have been watching the number of downloads of these versions, on a week-to-week basis since September, and while the raw numbers of downloaders have been decreasing (and the drastic uptick in downloaders in 2.9.14.1 and 2.9.15.0) there are still about 42,000 users on those two versions, so we urge everyone on those two versions to upgrade as soon as possible.

Thanks everyone! Happy upgrading.

Snort versions EOL and open-source Snort release schedule updates

It's time again for us to wind down certain versions of SNORTⓇ.

We currently support 36 different Open Source Operating System builds for the Snort Subscriber Rule Set. Each additional version of the OS and additional version of Snort that we have to support exponentially increases the amount of build — and, subsequently, QA — time required to create a version of the ruleset. To adjust this workload, we will be deprecating the following versions of Snort:

• 2.9.9.0
• 2.9.12.0

Using our regular 90-day notice policy, this means that those versions will deprecate on Dec. 18 later this year.

This will leave versions:

• 2.9.8.3
• 2.9.13.0
• 2.9.14.1
• 2.9.15.0

If you are on 2.9.9.0 or 2.9.12.0, we recommend you upgrade to 2.9.14.1 immediately.

We will be updating our EOL page on Snort.org soon to reflect this change as soon as we get a chance to push that live.

But, there is good news.

We are going to move to a more regular release schedule of about once a quarter. We will iron out the dates and details soon, at which time we'll let you know on the blog with an accompanying page on Snort.org. This will allow for more regular releases and easier depreciation of older releases.

If there are any concerns, please bring them to the Snort-Users mailing list.

Snort 2.9.11.0 end of life warning

SNORTⓇ subscribers, as many of you may have noticed, we've been keeping Snort version releases around a lot longer over the past couple of years.

We are currently working on revising our end of life (EOL) policy to take into account a mix of time and market share. Essentially, we will begin to shut down versions of Snort that make up less than 10 percent of our downloads or have been around for five years, whichever comes first. More details will be released about this soon.

Shared Object Rule OS build change is coming

Similar to my recent post, we will also be removing OpenSUSE 11/12 and Debian 6 from active support for Shared Object rules.

We have replaced those systems with support for:

OpenSUSE LEAP 15.0 x86-64
OpenSUSE LEAP 42.3 x86_64
Debian 7/8/9 for both 32bit and x64

Please provide us feedback here, or on the Snort-Sigs mailing list!  Thank you!

Snort 2.9.7.6 is *now* EOL!

Even though we announced the EOL of 2.9.7.6 back in March,  we kept 2.9.7.6 around for while to help the people that could not move off of 2.9.7.6 immediately.

However, our download count for 2.9.7.6 is down to "hey, I forgot about this install" levels, so we've removed the build from our package distribution.

In the near future we will have an announcement about adjusting our EOL schedule to better serve the community.  Keep your eyes on this blog!

Snort 2.9.7.6 is End of Life!

In accordance with our End of Life Policy, today's release marks the End of Life for Snort 2.9.7.6, as detailed in our blog post back in February.

Please start upgrading your Snort systems now if you are on Snort 2.9.7.6.

EOL for Snort 2.9.7.6 is approaching!

As you can see from our EOL page, the End of Life (EOL) for Snort version 2.9.7.6's ruleset is approaching on March 13th.

Our download numbers are clearly illustrating that most people have moved from 2.9.7.6 to 2.9.8.3 or 2.9.9.0, which is great.  However, it appears there are still several thousand users on 2.9.7.6.


Please take the next week to move off of 2.9.7.6 and onto a more updated version before the EOL date hits!

Thanks

Snort EOL dates have been updated.

With our recent release of Snort 2.9.9.0, as I stated in a previous blog post, this marks the beginning of the "end of life" for Snort 2.9.7.6.

We've updated the Snort EOL page today which marks the EOL for 2.9.7.6 (2017-03-14).

If you are interested on our "LTS" or Long Term Support version of Snort (2.9.8.3), I suggest you plan your migrations now.

2.9.8.3 will be supported until the next major release of Snort after 2.9.9.0.

If you want the newest features of the ruleset and Snort, we suggest you upgrade to 2.9.9.0, which is our current release.  For more on the features of Snort 2.9.9.0, please read out blog post.

Please remember, as per my previous blog post, 2.9.9.0's ruleset will not be backwards compatible to Snort 2.9.8.3 once the newer keywords are used.

Snort 2.9.8.2 is End of Life!

Just a notification to remind everyone that Snort 2.9.8.2 is now End of Life (EOL).  In accordance with our EOL policy, 2.9.8.2 met its EOL date today.

Now it is time to upgrade your engines, Snort 2.9.8.3 is the current version of Snort, and users should upgrade immediately.

Thanks for all of your support!

Snort 2.9.8.2 is rapidly approaching!

As you can see from our EOL page:

https://www.snort.org/eol

The EOL for Snort 2.9.8.2 is approaching in a couple days.   From our download statistics, the percentage of people is pretty small.

Please try and update your engines this week to 2.9.8.3, the current version. We also look forward to the release of 2.9.9.0 in the coming weeks, so for those of you still on 2.9.7.6, the EOL for 2.9.7.6 will be the release of 2.9.9.0 + 90 days (as a reminder).

So, 2.9.7.6 users, your EOL is coming too, and there are tens of thousands of you on that version.  It's upgrade time!

Snort 2.9.8.0 is now EOL!

Just a notification to remind everyone that Snort 2.9.8.0 is now End of Life (EOL).  In accordance with our EOL policy, and reminders we've posted here on the blog, 2.9.8.0 met it's EOL date today.

We released 2.9.8.0 in November of 2015.

Now it is time to upgrade your engines, Snort 2.9.8.3 is the current version of Snort, and we should upgrade immediately.

Thanks for all of your support!

Snort 2.9.8.0 is approaching EOL

As you can see from our EOL page:

https://www.snort.org/eol

The EOL for Snort 2.9.8.0 is approaching in a couple days.   From our download statistics, the percentage of people is pretty small, so it shouldn't be a great impact.  

Please try and update your engines this week to 2.9.8.3, the current version. Thanks!

Snort 2.9.6.2 is EOL!

Just a notification to remind everyone that Snort 2.9.6.2 is now End of Life (EOL).  In accordance with our EOL policy, and reminders we've posted here on the blog, 2.9.6.2 met it's EOL date today.

We released 2.9.6.2 in July of 2014, and I believe that sets the record for the longest supported version of Snort we've ever had with close to 200 rule releases for this version.

2.9.6.2 lived a good life, but now it's time to upgrade our engines, Snort 2.9.8.0 is the current version of Snort, and we should upgrade immediately.

Thanks for all of your support!

Snort 2.9.6.2 EOL Reminder!

Reminder for the 12,000 or so of you that are still on 2.9.6.2...

Its EOL is rapidly approaching (next week), and we should EOL it on 3/7/2016 (Monday).

Meaning, barring anything jarring this week, this Thursday (3/3/2016) should be the last day for Snort 2.9.6.2 builds of the ruleset.

The current version is 2.9.8.0, so, if you haven't upgraded yet, start your engines this week!

Snort 2.9.7.5 is EOL!

Snort 2.9.7.5 is officially supposed to EOL today, however, since many people are out on vacation through New Years, we've decided to keep the build system up until after the holidays.  

The current version of Snort is 2.9.8.0.   Those of you on older versions, please start upgrading.  

Snort 2.9.7.3 is now End of Life!

In accordance with our End-Of-Life (eol) policy, today's rule release was the last for Snort Version 2.9.7.3.

If you are on that version of Snort (or older) please consider transitioning to the most up to date version of Snort (Currently 2.9.7.6) immediately.