v4.5.5
Security relevant
⚠ Upgrade required
- YR_RE_SCAN_LIMIT has been reverted to 4096. If your environment was relying on a higher limit introduced in a prior release, regex-heavy rules may now truncate scans earlier than expected. Validate rule behavior after upgrading.
Breaking changes
- YR_RE_SCAN_LIMIT reverted to 4096 — any workflows or rules that relied on the previously increased limit may behave differently or fail to match as expected.
Security fixes
- Heap overflow when loading hand-crafted compiled rules (CVE not assigned in changelog, reported by Momoko Shiraishi, #2178)
Notable features
- Windows: --no-follow-symlinks option now implemented (6e11b5a)