Latest Downloads

The latest releases of YAF 2.x are listed below.

See also pre-releases of YAF 3.x and all YAF releases.

RPM Downloads

You can also find RPMs of YAF releases starting from 2.16.2 in our Yum repository.

YAF Release 2.20.3, 2026-Aug-12

Downloads

yaf-2.20.3.tar.gz (2.2MiB)

(SHA256=fb581317124a2a5064c17e211cc2a0226a41f606c2135a5a5c6f672ecf6e4c9f)

Changelog

  • Fixed a file handle leak when --rotate is used since YAF-2.20.

YAF Release 2.20.2, 2026-Aug-10

Downloads

yaf-2.20.2.tar.gz (2.2MiB)

(SHA256=d5365a76ce766891e98cb9e556a38c0077629727496d734725b24fcaed8a3534)

Changelog

  • Fixed a memory leak in the TLS DPI since YAF-2.20.

YAF Release 2.20.1, 2026-Aug-6

Downloads

yaf-2.20.1.tar.gz (2.2MiB)

(SHA256=fbcb2550a78c5427858abad53472fdde19c14f8b020aa0136e85db1cee62230a)

Changelog

  • Fixed a crash since 2.19.0 in the DPI processing for mysql data.
  • Fixed a potential out of bounds read in the DPI processing of SCADA protocols Modbus and EtherNet/IP.
  • Updated the TLS certificate DPI to accept more certificates.

YAF Release 2.19.5, 2026-Aug-3

Downloads

yaf-2.19.5.tar.gz (2.2MiB)

(SHA256=8fcfc4d8b8f52460784c3a44c99a3221341b3c2d780541bad2b4bee87ea0d834)

Changelog

  • Fixed a crash since 2.19.0 in the DPI processing for mysql data.
  • Fixed a potential out of bounds read in the DPI processing of SCADA protocols Modbus and EtherNet/IP.
  • Updated the TLS certificate DPI to accept more certificates.

YAF Release 2.20.0, 2026-Jul-30

Changelog

  • Upgrading: The yafDPIRules.conf file has changed (old files are still accepted).
  • Upgrading: The format of the names of rotating files has changed.
  • Upgrading: Made microsecond timestamps the only timestatmps exported by default. Use --time-elements to use different timestamps.
  • Added support for JA4 fingerprints of TLS clients' hello messages.
  • Added the ability to set the maximum number of DPI fields per direction in the yafDPIRules.conf file, e.g., "limit direction count 128".
  • Changed the existing "limit" settings in yafDPIRules.conf to accept the optional token "length" before the number, e.g., "limit field length 256".
  • Increased the default maximums of the number of DPI fields per direction, the length of a field, and the sum of the fields' lengths.
  • Changed the DPI code to make more attempts to reach the maximum sum of the fields' lengths.
  • Changed the format of rotating IPFIX file names to OUT-DATETIME-MICRO-SERIALRANDOM.yaf from OUT-DATETIME-SERIAL5.yaf.
  • Changed the format of rotating pcap file names to OUTDATETIME-MICRO-SERIALRANDOM.pcap from OUTDATETIME-SERIAL5.pcap.
  • Fixed a race condition when --lock is used.
  • Improved error reporting when parsing yafApplabelRules.conf and yafDPIRules.conf.
  • Added support for reading raw pcap files where all packets are either IPv4 or IPv6.

YAF Release 2.19.4, 2026-Jul-21

Downloads

yaf-2.19.4.tar.gz (2.2MiB)

(SHA256=300394f7ea7989e75db803d688e9396102b263734ebc12805ff1107526080d67)

Changelog

  • Fixed a regression in YAF-2.19.0 where customizing the TLS export via the yafDPIRules.conf file failed to enable TLS export.

YAF Release 2.19.3, 2026-May-28

Downloads

yaf-2.19.3.tar.gz (2.2MiB)

(SHA256=6b03bc3d25495c01d8d8020b00a908ef1ed28b6edf78f631618208d81e809b30)

Changelog

  • Fixed an issue that made RPM installs of YAF 2.19.x unable to load plugin modules.

YAF Release 2.19.2, 2026-May-14

Downloads

yaf-2.19.2.tar.gz (2.2MiB)

(SHA256=dbe9413ce366c0ea2a104d45d86b21f5518f0d3b5c210c9a5c0d109642fea6a7)

Changelog

  • Fixed a file handle leak when reading PCAPNG capture files.

YAF Release 2.19.1, 2026-Apr-23

Downloads

yaf-2.19.1.tar.gz (2.2MiB)

(SHA256=d2bab3eab2a227eaeedc8624c69dfb77a7ba314d02c3f050cbb829e7ccf66271)

Changelog

  • Fixed potential file corruption when multiple YAF processes are using --lock --rotate and writing to the same directory, where one process could remove another's lock file and permit a third process to write simultaneously to the first process's output file.
  • Improved run-time error messages when using --caplist.
  • Improved the documentation for --pcap and options related to creating pcap files, and improved the command-line checks for these options.
  • Reduced the memory used by dpacketplugin for non-(TCP,UDP) flows when --protocol-payload is given.
  • Fixed an error where the --pcap-meta-file would sometimes record the input file name instead of the output file when when creating rolling pcap files and --caplist was used.
  • Fixed memory corruption in 2.19.0 if --uniflow is used when dpacketplugin is active.
  • Fixed a compilation error in 2.19.0 when Spread support is enabled.
  • Stopped YAF from putting Tombstone records in a separate IPFIX message.

Visit Release History for older releases.