diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 7373affc..16877239 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -17,6 +17,6 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
       - name: Codespell
         uses: codespell-project/actions-codespell@v2
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index ee6305c4..4d3897b3 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -22,15 +22,15 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [3.8, 3.9, '3.10', '3.11', '3.12', '3.13', '3.14', '3.15.0-alpha.5', pypy3.11]
+        python-version: [3.8, 3.9, '3.10', '3.11', '3.12', '3.13', '3.14', '3.15.0-rc.2', pypy3.11]
       fail-fast: false
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
 
diff --git a/ChangeLog b/ChangeLog
index 216ffe88..32f2dec0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,7 +7,24 @@
 Fail2Ban: Changelog
 ===================
 
-ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
+ver. 1.1.2-dev-1 (20??/??/??) - development nightly edition
+-----------
+
+### Fixes
+* `filter.d/nginx-botsearch.conf` - error-log regex extended with support of journal format (gh-3732)
+* `filter.d/apache-noscript.conf` - match a request for the `cgi-bin` directory itself (no script name after it),
+  the `cgi-bin` alternative required a following path segment so `/cgi-bin/` and `/cgi-bin` were not matched (gh-4217)
+* sockets passed via `systemd` socket activation (`sd_listen_fds(3)`) are not shut down or removed anymore (gh-4225)
+* `paths-*.conf`: add default banactions for several includes depending on default net-filter for distribution (gh-4224, gh-4229):
+  `paths-arch.conf`, `paths-fedora.conf`, `paths-opensuse.conf` - nftables, `paths-freebsd.conf`, `paths-osx.conf ` - pf;
+
+### New Features and Enhancements
+* `filter.d/cowrie.conf` - new filter and jail for Cowrie SSH/Telnet honeypot JSON log output (gh-4216)
+* `filter.d/gitlab.conf` - `logtype` option `json` adding support for the `application_json.log` format that
+  superseded the deprecated `application.log`; default type `file` keeps the previous behaviour (gh-3566, gh-4230)
+
+
+ver. 1.1.1 (2026/08/15) - triple-one-win
 -----------
 
 ### Compatibility
@@ -18,6 +35,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
   to use it as before set `mode = more` for exim jail, but be aware of the consequences.
 
 ### Fixes
+* fixes catastrophic backtracking explosion for REs in domino-smtp and dovecot filters (GHSA-33wh-ccjc-p397, gh-4221)
 * fixes `systemd` bug with missing journal descriptor after rotation by reopening of journal if it is recognized as not alive (gh-3929)
 * improve threaded clean-up of all filters, new thread functions `afterStop` (to force clean-up after stop) and `done`, invoking `afterStop` once
 * ensure journal-reader is always closed (additional prevention against leaks and "too many open files"), thereby avoid sporadic segfault
@@ -65,6 +83,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
   - add optional `NOQUEUE:` prefix to ddos regex (gh-4072)
   - internal parameter `_pref` is renamed to `_cmd`, `_pref` matches now optional prefix like `NOQUEUE: ` etc
   - modes `ddos` and `aggressive` extended to match `rate limit exceeded` for connection or message delivery request rates (gh-3265, gh-4073)
+  - modes `aggressive` extended to match `hostname does not resolve to address` (gh-4218, gh-4078)
 * `filter.d/dropbear.conf`:
   - recognizes extra pid/timestamp if logged into stdout/journal, added `journalmatch` (gh-3597)
   - failregex extended to match different format of "Exit before auth" message (gh-3791)
@@ -83,6 +102,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
 * `filter.d/froxlor-auth.conf` - updated the regex to the new logging situation for froxlor and changed logpath in jail.conf (gh-4075).	
 
 ### New Features and Enhancements
+* `fail2ban-server` supports `systemd` socket activation (`sd_listen_fds(3)`); optional `fail2ban.socket` unit provided
 * backend `systemd` extended with new parameter `rotated` (default `false`, as prevention against "too many open files"),
   that allows to monitor only actual journals and ignore now a lot of rotated files by default; so can drastically reduce
   amount of used file descriptors, normally to 1 or 2 descriptors per jail (gh-3391)
diff --git a/MANIFEST b/MANIFEST
index 972a2b48..5fbd4e10 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -11,6 +11,7 @@ config/action.d/bsd-ipfw.conf
 config/action.d/cloudflare.conf
 config/action.d/cloudflare-token.conf
 config/action.d/complain.conf
+config/action.d/csf.conf
 config/action.d/dshield.conf
 config/action.d/dummy.conf
 config/action.d/firewallcmd-allports.conf
@@ -129,6 +130,7 @@ config/filter.d/nginx-http-auth.conf
 config/filter.d/nginx-limit-req.conf
 config/filter.d/nsd.conf
 config/filter.d/openhab.conf
+config/filter.d/openvpn.conf
 config/filter.d/openwebmail.conf
 config/filter.d/oracleims.conf
 config/filter.d/pam-generic.conf
@@ -138,6 +140,7 @@ config/filter.d/php-url-fopen.conf
 config/filter.d/portsentry.conf
 config/filter.d/postfix.conf
 config/filter.d/proftpd.conf
+config/filter.d/proxmox.conf
 config/filter.d/pure-ftpd.conf
 config/filter.d/qmail.conf
 config/filter.d/recidive.conf
@@ -162,10 +165,12 @@ config/filter.d/suhosin.conf
 config/filter.d/tine20.conf
 config/filter.d/traefik-auth.conf
 config/filter.d/uwimap-auth.conf
+config/filter.d/vaultwarden.conf
 config/filter.d/vsftpd.conf
 config/filter.d/webmin-auth.conf
 config/filter.d/wuftpd.conf
 config/filter.d/xinetd-fail.conf
+config/filter.d/xrdp.conf
 config/filter.d/znc-adminlog.conf
 config/filter.d/zoneminder.conf
 config/jail.conf
@@ -340,6 +345,7 @@ fail2ban/tests/files/logs/nginx-http-auth
 fail2ban/tests/files/logs/nginx-limit-req
 fail2ban/tests/files/logs/nsd
 fail2ban/tests/files/logs/openhab
+fail2ban/tests/files/logs/openvpn
 fail2ban/tests/files/logs/openwebmail
 fail2ban/tests/files/logs/oracleims
 fail2ban/tests/files/logs/pam-generic
@@ -349,6 +355,7 @@ fail2ban/tests/files/logs/php-url-fopen
 fail2ban/tests/files/logs/portsentry
 fail2ban/tests/files/logs/postfix
 fail2ban/tests/files/logs/proftpd
+fail2ban/tests/files/logs/proxmox
 fail2ban/tests/files/logs/pure-ftpd
 fail2ban/tests/files/logs/qmail
 fail2ban/tests/files/logs/recidive
@@ -373,10 +380,12 @@ fail2ban/tests/files/logs/suhosin
 fail2ban/tests/files/logs/tine20
 fail2ban/tests/files/logs/traefik-auth
 fail2ban/tests/files/logs/uwimap-auth
+fail2ban/tests/files/logs/vaultwarden
 fail2ban/tests/files/logs/vsftpd
 fail2ban/tests/files/logs/webmin-auth
 fail2ban/tests/files/logs/wuftpd
 fail2ban/tests/files/logs/xinetd-fail
+fail2ban/tests/files/logs/xrdp
 fail2ban/tests/files/logs/znc-adminlog
 fail2ban/tests/files/logs/zoneminder
 fail2ban/tests/files/logs/zzz-generic-example
@@ -390,6 +399,7 @@ fail2ban/tests/files/testcase-journal.log
 fail2ban/tests/files/testcase-multiline.log
 fail2ban/tests/files/testcase-usedns.log
 fail2ban/tests/files/testcase-wrong-char.log
+fail2ban/tests/files/test-ign-ips-file
 fail2ban/tests/files/zzz-sshd-obsolete-multiline.log
 fail2ban/tests/filtertestcase.py
 fail2ban/tests/__init__.py
@@ -410,7 +420,7 @@ files/fail2ban-logrotate
 files/fail2ban-openrc.conf
 files/fail2ban-openrc.init.in
 files/fail2ban.service.in
-files/fail2ban-tmpfiles.conf
+files/fail2ban.socket.in
 files/fail2ban.upstart
 files/gen_badbots
 files/ipmasq-ZZZzzz_fail2ban.rul
diff --git a/README.md b/README.md
index 9d5a5959..d6da5e71 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
                         / _|__ _(_) |_  ) |__  __ _ _ _  
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
-                       v1.1.0.dev1            20??/??/??
+                       v1.1.2.dev1            20??/??/??
 
 ## Fail2Ban: ban hosts that cause multiple authentication errors
 
diff --git a/config/action.d/nftables.conf b/config/action.d/nftables.conf
index 94ff9cdf..ef3dbedc 100644
--- a/config/action.d/nftables.conf
+++ b/config/action.d/nftables.conf
@@ -35,7 +35,11 @@ type = multiport
 rule_match-custom =
 rule_match-allports = meta l4proto \{ <protocol> \}
 rule_match-multiport = $proto dport \{ $(echo '<port>' | sed s/:/-/g) \}
+rule_match-allprotos-custom =
+rule_match-allprotos-allports =
+rule_match-allprotos-multiport = th dport \{ $(echo '<port>' | sed s/:/-/g) \}
 match = <rule_match-<type>>
+match_allprotos = <rule_match-allprotos-<type>>
 
 # Option:  rule_stat
 # Notes.:  statement for nftables filter rule.
@@ -43,6 +47,7 @@ match = <rule_match-<type>>
 # Values:  nftables statement
 #
 rule_stat = %(match)s <addr_family> saddr @<addr_set> <blocktype>
+rule_stat_allprotos = %(match_allprotos)s <addr_family> saddr @<addr_set> <blocktype>
 
 # optional iterator over protocol's:
 _nft_for_proto-custom-iter =
@@ -56,9 +61,13 @@ _nft_list = <nftables> -a list chain <table_family> <table> <chain>
 _nft_get_handle_id = sed -nE 's/.*@<addr_set>\s+.*\s+\#\s*(handle\s+[0-9]+)$/\1/p'
 
 _nft_add_set = <nftables> add set <table_family> <table> <addr_set> \{ type <addr_type>\;<addr_options> \}
+              if [ '<protocol>' != "all" ]; then
               <_nft_for_proto-<type>-iter>
               <nftables> add rule <table_family> <table> <chain> %(rule_stat)s
               <_nft_for_proto-<type>-done>
+              else
+              <nftables> add rule <table_family> <table> <chain> %(rule_stat_allprotos)s
+              fi
 _nft_del_set = { %(_nft_list)s | %(_nft_get_handle_id)s; } | while read -r hdl; do
                <nftables> delete rule <table_family> <table> <chain> $hdl; done
               <nftables> delete set <table_family> <table> <addr_set>
diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index d8f9fdfd..a49afa10 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -17,12 +17,12 @@ before = apache-common.conf
 
 [Definition]
 
-script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin/)
+script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin)
 
 prefregex = ^%(_apache_error_client)s (?:AH0(?:01(?:28|30)|1(?:264|071)|2811): )?(?=(?:[Ff]ile|[Ss]cript|[Gg]ot error|stderr from) )<F-CONTENT>.+</F-CONTENT>$
 
 failregex = ^(?:(?:[Ff]ile does not exist|[Ss]cript not found or unable to stat): <script>\b|[Gg]ot error '[Pp]rimary script unknown\b)
-            ^(?:stderr from |script (?P<_q>'))<script>\S*(?(_q)'|) (?:script )?(?:does not exist|not found or unable to stat)
+            ^(?:stderr from |script (?P<_q>'))<script>\b\S*(?(_q)'|) (?:script )?(?:does not exist|not found or unable to stat)
 
 ignoreregex = 
 
diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf
index e6b3c641..566883b2 100644
--- a/config/filter.d/common.conf
+++ b/config/filter.d/common.conf
@@ -82,8 +82,7 @@ datepattern = %(lt_short/datepattern)s
 
 [lt_rfc5424]
 # RFC 5424 log-format, see gh-2309:
-#__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ \S+\s+
-__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ (?:[^\[\]\s]+|(?:\[(?:[^\]"]*|"[^"]*")*\])+)\s+
+__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ (?:-|(?:\[(?:[^\]"]|"(?:[^"\\]|\\.)*")*\])+)\s+
 datepattern = ^<\d+>\d+\s+{DATE}
 
 # Author: Yaroslav Halchenko, Sergey G. Brester (aka sebres)
diff --git a/config/filter.d/cowrie.conf b/config/filter.d/cowrie.conf
new file mode 100644
index 00000000..704e26fc
--- /dev/null
+++ b/config/filter.d/cowrie.conf
@@ -0,0 +1,22 @@
+# Fail2Ban filter for Cowrie SSH/Telnet honeypot (https://github.com/cowrie/cowrie)
+# Detects new connections logged in Cowrie's JSON output format
+# (log.format = json / output.jsonlog in cowrie.cfg), one JSON object per line, e.g.:
+#   {"session":"2a5e755afa79","protocol":"ssh","src_ip":"1.2.3.4","src_port":41000,
+#    "dst_ip":"172.18.0.2","dst_port":2222,"eventid":"cowrie.session.connect",
+#    "sensor":"myhost","uuid":"8c5b1af2-...","timestamp":"2024-01-01T00:00:00.000000Z",
+#    "message":"New connection: ..."}
+# As Cowrie is a honeypot, any connection to it is unsolicited by definition.
+
+[Init]
+
+datepattern = "timestamp":"(%%ExY-%%m-%%dT%%H:%%M:%%S(?:\.%%f)?Z?)"
+
+[Definition]
+
+# bounded run of arbitrary "key":value pairs (string/number), used to skip
+# over fields we don't care about without resorting to an unbounded ".*"
+_kv = (?:\s*"(?!(?:src_ip|eventid)\b)\w[^"]+"\s*:\s*(?:"[^"]+"|\w+)\s*[,\}]){0,20}
+datepattern = ^\{%(_kv)s("timestamp":"%%Y-%%m-%%dT%%H:%%M:%%S\.%%f%%z"\s*,\s*)
+failregex = ^\{%(_kv)s"src_ip":"<ADDR>",%(_kv)s"eventid":"cowrie\.session\.connect"
+
+ignoreregex =
diff --git a/config/filter.d/domino-smtp.conf b/config/filter.d/domino-smtp.conf
index 638cd7c5..2bac9f1c 100644
--- a/config/filter.d/domino-smtp.conf
+++ b/config/filter.d/domino-smtp.conf
@@ -23,10 +23,7 @@
 
 [Definition]
 # Option:  failregex
-# Notes.:  regex to match the password failure messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+# Notes.:  regex to match the password failure messages in the logfile.
 # Values:  TEXT
 #
 # Sample log entries (used different time formats and an extra sample with process info in front of date)
@@ -37,9 +34,9 @@
 
 __prefix = (?:\[[^\]]+\])?\s*
 __opt_data = (?::|\s+\[[^\]]+\])
-failregex = ^%(__prefix)sSMTP Server%(__opt_data)s Authentication failed for user .*? \; connecting host \[?<HOST>\]?$
-            ^%(__prefix)ssmtp: (?:[^\[]+ )*\[?<HOST>\]? authentication failure using internet password\s*$
-            ^%(__prefix)sSMTP Server%(__opt_data)s Connection from \[?<HOST>\]? rejected for policy reasons\.
+failregex = ^%(__prefix)sSMTP Server%(__opt_data)s Authentication failed for user .*? \; connecting host \[?<ADDR>\]?$
+            ^%(__prefix)ssmtp: (?:<F-USER>(?:[^\[ ]+ )*[^\[ ]+</F-USER> )?\[?<ADDR>\]? authentication failure using internet password\s*$
+            ^%(__prefix)sSMTP Server%(__opt_data)s Connection from \[?<ADDR>\]? rejected for policy reasons\.
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
index 0a0d73e6..4a3b3ee7 100644
--- a/config/filter.d/dovecot.conf
+++ b/config/filter.d/dovecot.conf
@@ -15,7 +15,7 @@ _auth_driver = [a-z\-]+
 
 _auth_worker = (?:dovecot: )?auth(?:-worker)?
 _auth_worker_info = (?:%(_auth_driver)s: )?(?:conn \w+:auth(?:-worker)? \([^\)]+\): auth(?:-worker)?<\d+>: )?
-_bypass_reject_reason = (?:: (?:\w+\([^\):]*\) \w+|[^\(]+))*
+_bypass_reject_reason = (?::(?: [^\( ]*|\([^\(]*\))*)?
 
 prefregex = ^%(__prefix_line)s(?:%(_auth_worker)s(?:\((?:\S*,<ADDR>(?:,\S*)?|[^\)]+)\))?(?:<[^>]+>)?: )?(?:%(__pam_auth)s(?:\(dovecot:auth\))?: |(?:pop3|imap|managesieve|submission)-login: )?(?:request \[\d+\]: )?(?:Info: )?%(_auth_worker_info)s<F-CONTENT>.+</F-CONTENT>$
 
diff --git a/config/filter.d/gitlab.conf b/config/filter.d/gitlab.conf
index 0c614ae5..824f3f77 100644
--- a/config/filter.d/gitlab.conf
+++ b/config/filter.d/gitlab.conf
@@ -1,6 +1,32 @@
 # Fail2Ban filter for Gitlab
 # Detecting unauthorized access to the Gitlab Web portal
-# typically logged in /var/log/gitlab/gitlab-rails/application.log
+#
+# logtype "file" (default) reads the legacy application.log, typically logged in
+# /var/log/gitlab/gitlab-rails/application.log
+#
+# logtype "json" reads the structured application_json.log that superseded it
+# (application.log was deprecated by Gitlab in 15.10), typically logged in
+# /var/log/gitlab/gitlab-rails/application_json.log
 
 [Definition]
+
+# Log format: "file" (application.log) or "json" (application_json.log)
+logtype = file
+
+failregex = <lt_<logtype>/failregex>
+datepattern = <lt_<logtype>/datepattern>
+ignoreregex =
+
+[lt_file]
+
 failregex = ^: Failed Login: username=<F-USER>.+</F-USER> ip=<HOST>$
+datepattern = {^LN-BEG}%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?
+
+[lt_json]
+
+# bounded run of "key":value pairs, used to skip over fields we don't care
+# about (order of tags in the message is significant, so relative positions
+# of time, meta.remote_ip and message are anchored below)
+_groupre = (?:\s*"(?!(?:time|meta\.remote_ip|message)\b)\w[^"]+"\s*:\s*(?:"[^"]+"|\w+)\s*[,\}])
+failregex = ^%(_groupre)s*"meta\.remote_ip":"<ADDR>"\s*,\s*%(_groupre)s*"message":"Failed Login: username=<F-USER>(?:\S*|[^"]*?)(?= ip=)</F-USER>
+datepattern = ^\{%(_groupre)s*"time":"%%Y-%%m-%%dT%%H:%%M:%%S\.%%f%%z"\s*,\s*
diff --git a/config/filter.d/nginx-botsearch.conf b/config/filter.d/nginx-botsearch.conf
index 2bd23072..4cff8ad2 100644
--- a/config/filter.d/nginx-botsearch.conf
+++ b/config/filter.d/nginx-botsearch.conf
@@ -5,11 +5,12 @@
 
 # Load regexes for filtering
 before = botsearch-common.conf
+         nginx-error-common.conf
 
 [Definition]
 
 failregex = ^<HOST> \- \S+ \[\] \"(GET|POST|HEAD) \/<block> \S+\" 404 .+$
-            ^ \[error\] \d+#\d+: \*\d+ (\S+ )?\"\S+\" (failed|is not found) \(2\: No such file or directory\), client\: <HOST>\, server\: \S*\, request: \"(GET|POST|HEAD) \/<block> \S+\"\, .*?$
+            ^%(__prefix_line)s(\S+ )?\"\S+\" (failed|is not found) \(2\: No such file or directory\), client\: <HOST>\, server\: \S*\, request: \"(GET|POST|HEAD) \/<block> \S+\"\, .*?$
 
 ignoreregex = 
 
diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf
index 305e2ded..0c7f34b0 100644
--- a/config/filter.d/postfix.conf
+++ b/config/filter.d/postfix.conf
@@ -59,6 +59,7 @@ mdad-extra =
 mdpr-aggressive = (?:%(mdpr-auth)s|%(mdpr-normal)s|%(mdpr-ddos)s)
 mdre-aggressive = %(mdre-auth2)s
                   %(mdre-normal)s
+                  ^hostname \S+ does not resolve to address <ADDR>
 mdad-aggressive = %(mdad-ddos)s
 
 mdpr-errors = too many errors after \S+
diff --git a/config/jail.conf b/config/jail.conf
index bf714f0d..8f02e9af 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -865,6 +865,7 @@ protocol = udp
 logpath  = /usr/local/vpnserver/security_log/*/sec.log
 
 [gitlab]
+# for the newer application_json.log set: filter = gitlab[mode=json]
 port    = http,https
 logpath = /var/log/gitlab/gitlab-rails/application.log
 
@@ -995,3 +996,7 @@ logpath = /var/log/vaultwarden.log
 [xrdp]
 port    = 3389
 logpath = /var/log/xrdp-sesman.log
+
+[cowrie]
+port    = ssh,telnet,2222,2223
+logpath = /var/log/cowrie/cowrie.json
diff --git a/config/paths-arch.conf b/config/paths-arch.conf
index 270ce65d..af8c5087 100644
--- a/config/paths-arch.conf
+++ b/config/paths-arch.conf
@@ -9,6 +9,9 @@ after  = paths-overrides.local
 
 [DEFAULT]
 
+banaction = nftables
+banaction_allports = nftables[type=allports]
+
 apache_error_log = /var/log/httpd/*error_log
 
 apache_access_log = /var/log/httpd/*access_log
diff --git a/config/paths-fedora.conf b/config/paths-fedora.conf
index 3d637e1f..d2aba824 100644
--- a/config/paths-fedora.conf
+++ b/config/paths-fedora.conf
@@ -9,6 +9,9 @@ after  = paths-overrides.local
 
 [DEFAULT]
 
+banaction = nftables
+banaction_allports = nftables[type=allports]
+
 syslog_mail = /var/log/maillog
 
 syslog_mail_warn = /var/log/maillog
diff --git a/config/paths-freebsd.conf b/config/paths-freebsd.conf
index 550ee887..91c6e672 100644
--- a/config/paths-freebsd.conf
+++ b/config/paths-freebsd.conf
@@ -9,6 +9,9 @@ after  = paths-overrides.local
 
 [DEFAULT]
 
+banaction = pf
+banaction_allports = pf[actiontype=<allports>]
+
 # http://www.freebsd.org/doc/handbook/configtuning-syslog.html
 #
 syslog_mail = /var/log/maillog
diff --git a/config/paths-opensuse.conf b/config/paths-opensuse.conf
index f1d70ce7..d4629d0c 100644
--- a/config/paths-opensuse.conf
+++ b/config/paths-opensuse.conf
@@ -9,12 +9,27 @@ after  = paths-overrides.local
 
 [DEFAULT]
 
+banaction = nftables
+banaction_allports = nftables[type=allports]
+
+syslog_local0  = /var/log/messages
+
 syslog_mail = /var/log/mail
 
 syslog_mail_warn = %(syslog_mail)s
 
 syslog_authpriv = %(syslog_local0)s
 
+syslog_user =  %(syslog_local0)s
+
+syslog_ftp  = %(syslog_local0)s
+
+syslog_daemon  = %(syslog_local0)s
+
+apache_error_log = /var/log/apache2/*error_log
+
+apache_access_log = /var/log/apache2/*access_log
+
 pureftpd_log = %(syslog_local0)s
 
 exim_main_log = /var/log/exim/main.log
diff --git a/config/paths-osx.conf b/config/paths-osx.conf
index 2fffd65a..b36d65f5 100644
--- a/config/paths-osx.conf
+++ b/config/paths-osx.conf
@@ -10,6 +10,9 @@ after  = paths-overrides.local
 
 [DEFAULT]
 
+banaction = pf
+banaction_allports = pf[actiontype=<allports>]
+
 syslog_mail = /var/log/mail.log
 
 syslog_mail_warn = /var/log/mail.warn
diff --git a/fail2ban/server/asyncserver.py b/fail2ban/server/asyncserver.py
index 62d6cce5..d6dde1fe 100644
--- a/fail2ban/server/asyncserver.py
+++ b/fail2ban/server/asyncserver.py
@@ -201,6 +201,7 @@ class AsyncServer(asyncore.dispatcher):
 		asyncore.dispatcher.__init__(self)
 		self.__transmitter = transmitter
 		self.__sock = "/var/run/fail2ban/fail2ban.sock"
+		self.__shutdown_socket = True
 		self.__init = False
 		self.__active = False
 		self.__errCount = {'accept': 0, 'listen': 0}
@@ -236,35 +237,56 @@ class AsyncServer(asyncore.dispatcher):
 		# Creates an instance of the handler class to handle the
 		# request/response on the incoming connection.
 		RequestHandler(conn, self.__transmitter)
-	
+
+	def setup_socket(self, sock, force):
+		nfds = os.environ.get("LISTEN_FDS")
+		if nfds and os.environ.get("LISTEN_PID") == str(os.getpid()):
+			# systemd socket activation (sd_listen_fds(3)): reuse an inherited,
+			# already bound and listening socket instead of creating our own.
+			names = os.environ.get("LISTEN_FDNAMES", "").split(":")
+			idx = names.index("fail2ban") if "fail2ban" in names else 0
+			idx = min(idx, int(nfds) - 1)
+			os.environ.pop("LISTEN_PID", None)
+			os.environ.pop("LISTEN_FDS", None)
+			os.environ.pop("LISTEN_FDNAMES", None)
+			logSys.info("Using socket activation, inherited socket %r", sock)
+			# prevent socket from being shut down on close
+			self.__shutdown_socket = False
+			self.set_socket(socket.socket(socket.AF_UNIX, socket.SOCK_STREAM, fileno=3 + idx))
+			self.socket.setblocking(False)
+			self.accepting = True
+		else:
+			# Remove socket
+			if os.path.exists(sock):
+				logSys.error("Fail2ban seems to be already running")
+				if force:
+					logSys.warning("Forcing execution of the server")
+					self._remove_sock()
+				else:
+					raise AsyncServerException("Server already running")
+			# Creates the socket.
+			self.create_socket(socket.AF_UNIX, socket.SOCK_STREAM)
+			self.set_reuse_addr()
+			try:
+				self.bind(sock)
+			except Exception: # pragma: no cover
+				raise AsyncServerException("Unable to bind socket %s" % self.__sock)
+			self.listen(1)
+			# Sets the init flag.
+			self.__init = True
+		AsyncServer.__markCloseOnExec(self.socket)
+
 	##
 	# Starts the communication server.
 	#
 	# @param sock: socket file.
 	# @param force: remove the socket file if exists.
-	
+
 	def start(self, sock, force, timeout=None, use_poll=False):
 		self.__worker = threading.current_thread()
 		self.__sock = sock
-		# Remove socket
-		if os.path.exists(sock):
-			logSys.error("Fail2ban seems to be already running")
-			if force:
-				logSys.warning("Forcing execution of the server")
-				self._remove_sock()
-			else:
-				raise AsyncServerException("Server already running")
-		# Creates the socket.
-		self.create_socket(socket.AF_UNIX, socket.SOCK_STREAM)
-		self.set_reuse_addr()
-		try:
-			self.bind(sock)
-		except Exception: # pragma: no cover
-			raise AsyncServerException("Unable to bind socket %s" % self.__sock)
-		AsyncServer.__markCloseOnExec(self.socket)
-		self.listen(1)
-		# Sets the init flag.
-		self.__init = self.__loop = self.__active = True
+		self.setup_socket(sock, force)
+		self.__loop = self.__active = True
 		# Execute on start event (server ready):
 		if self.onstart:
 			self.onstart()
@@ -279,7 +301,7 @@ class AsyncServer(asyncore.dispatcher):
 		if self.__active:
 			self.__loop = False
 			# shutdown socket here:
-			if self.socket:
+			if self.__shutdown_socket and self.socket:
 				try:
 					self.socket.shutdown(socket.SHUT_RDWR)
 				except socket.error: # pragma: no cover - normally unreachable
diff --git a/fail2ban/server/filtersystemd.py b/fail2ban/server/filtersystemd.py
index 6bb9d466..045a8a37 100644
--- a/fail2ban/server/filtersystemd.py
+++ b/fail2ban/server/filtersystemd.py
@@ -23,6 +23,7 @@ __copyright__ = "Copyright (c) 2013 Steven Hiscocks"
 __license__ = "GPL"
 
 import os
+import threading
 import time
 
 from glob import glob
@@ -60,11 +61,11 @@ def _globJournalFiles(flags=None, path=None):
 		"""add journal files to set corresponding path and flags (without rotated *@*.journal)"""
 		# system journal:
 		if (flags is None) or (flags & journal.SYSTEM_ONLY):
-			filesSet |= set(glob(_join(p,'system.journal'))) - set(glob(_join(p,'system*@*.journal')))
+			filesSet |= set(glob(_join(p,'system.journal')))
 		# current user-journal:
 		if (flags is not None) and (flags & journal.CURRENT_USER):
 			uid = os.geteuid()
-			filesSet |= set(glob(_join(p,('user-%s.journal' % uid)))) - set(glob(_join(p,('user-%s@*.journal' % uid))))
+			filesSet |= set(glob(_join(p,('user-%s.journal' % uid))))
 		# all local journals:
 		if (flags is None) or not (flags & (journal.SYSTEM_ONLY|journal.CURRENT_USER)):
 			filesSet |= set(glob(_join(p,'*.journal'))) - set(glob(_join(p,'*@*.journal')))
@@ -102,6 +103,7 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover
 		JournalFilter.__init__(self, jail, **kwargs)
 		self.__modified = 0
 		# Initialise systemd-journal connection
+		self.__lock = threading.Lock()
 		self.__journal = journal.Reader(**self.__jrnlargs)
 		self.__matches = []
 		self.__bypassInvalidateMsg = 0
@@ -170,7 +172,7 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover
 		"""
 		try:
 			# open?
-			if self.__journal.closed: # pragma: no cover
+			if not self.__journal or self.__journal.closed: # pragma: no cover
 				return False
 			# has cursor? if it is broken (e. g. no descriptor) - it'd raise this:
 			# OSError: [Errno 99] Cannot assign requested address
@@ -196,10 +198,10 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover
 					ja.get('flags', 0), ja.get('path'), ja.get('files'), ja.get('namespace'))
 			except:
 				# cannot reopen in that way, so simply recreate reader:
-				self.closeJournal()
+				self._closeJournal()
 				self.__journal = journal.Reader(**self.__jrnlargs)
 		# restore journalmatch specified for the jail:
-		self.resetJournalMatches()
+		self._resetJournalMatches()
 		# just to avoid "Invalidate signaled" happening again after reopen:
 		self.__bypassInvalidateMsg = MyTime.time() + 1
 
@@ -226,28 +228,32 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover
 	# @param match journalctl syntax matches in list structure
 
 	def addJournalMatch(self, match):
-		newMatches = [[]]
-		for match_element in match:
-			if match_element == "+":
-				newMatches.append([])
+		with self.__lock:
+			if not self.__journal or self.__journal.closed:
+				return
+			newMatches = [[]]
+			for match_element in match:
+				if match_element == "+":
+					newMatches.append([])
+				else:
+					newMatches[-1].append(match_element)
+			try:
+				self._addJournalMatches(newMatches)
+			except ValueError:
+				logSys.error(
+					"Error adding journal match for: %r", " ".join(match))
+				self._resetJournalMatches()
+				raise
 			else:
-				newMatches[-1].append(match_element)
-		try:
-			self._addJournalMatches(newMatches)
-		except ValueError:
-			logSys.error(
-				"Error adding journal match for: %r", " ".join(match))
-			self.resetJournalMatches()
-			raise
-		else:
-			logSys.info("[%s] Added journal match for: %r", self.jailName, 
-				" ".join(match))
+				logSys.info("[%s] Added journal match for: %r", self.jailName, 
+					" ".join(match))
+
 	##
 	# Reset a journal match filter called on removal or failure
 	#
 	# @return None 
 
-	def resetJournalMatches(self):
+	def _resetJournalMatches(self):
 		self.__journal.flush_matches()
 		logSys.debug("[%s] Flushed all journal matches", self.jailName)
 		match_copy = self.__matches[:]
@@ -266,19 +272,22 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover
 	# @param match journalctl syntax matches
 
 	def delJournalMatch(self, match=None):
-		# clear all:
-		if match is None:
-			if not self.__matches:
+		with self.__lock:
+			if not self.__journal or self.__journal.closed:
 				return
-			del self.__matches[:]
-		# delete by index:
-		elif match in self.__matches:
-			del self.__matches[self.__matches.index(match)]
-		else:
-			raise ValueError("Match %r not found" % match)
-		self.resetJournalMatches()
-		logSys.info("[%s] Removed journal match for: %r", self.jailName, 
-			match if match else '*')
+			# clear all:
+			if match is None:
+				if not self.__matches:
+					return
+				del self.__matches[:]
+			# delete by index:
+			elif match in self.__matches:
+				del self.__matches[self.__matches.index(match)]
+			else:
+				raise ValueError("Match %r not found" % match)
+			self._resetJournalMatches()
+			logSys.info("[%s] Removed journal match for: %r", self.jailName, 
+				match if match else '*')
 
 	##
 	# Get current journal match filter
@@ -457,10 +466,11 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover
 							except OSError:
 								pass
 						# if it is not alive - reopen:
-						if not self._journalAlive:
-							logSys.log(logging.MSG, "[%s] Journal reader seems to be offline, reopen journal", self.jailName)
-							self._reopenJournal()
-							wcode = journal.NOP
+						with self.__lock:
+							if not self._journalAlive:
+								logSys.log(logging.MSG, "[%s] Journal reader seems to be offline, reopen journal", self.jailName)
+								self._reopenJournal()
+								wcode = journal.NOP
 				self.__modified = 0
 				while self.active:
 					logentry = None
@@ -527,7 +537,7 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover
 		logSys.debug("[%s] filter exited (systemd)", self.jailName)
 		return True
 
-	def closeJournal(self):
+	def _closeJournal(self):
 		try:
 			jnl, self.__journal = self.__journal, None
 			if jnl:
@@ -558,8 +568,9 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover
 
 	def afterStop(self):
 		"""Cleanup"""
-		# close journal:
-		self.closeJournal()
+		with self.__lock:
+			# close journal:
+			self._closeJournal()
 		# ensure positions of pending logs are up-to-date:
 		if self._pendDBUpdates and self.jail.database:
 			self._updateDBPending()
diff --git a/fail2ban/tests/files/logs/apache-noscript b/fail2ban/tests/files/logs/apache-noscript
index 0478cac9..cd48216c 100644
--- a/fail2ban/tests/files/logs/apache-noscript
+++ b/fail2ban/tests/files/logs/apache-noscript
@@ -26,3 +26,6 @@
 
 # failJSON: { "time": "2024-12-18T23:58:03", "match": true , "host": "192.0.2.74", "desc": "script not found, changed log-format with stderr from (gh-3900)" }
 [Wed Dec 18 23:58:03.148113 2024] [cgi:error] [pid 16720:tid 1878] [client 192.0.2.74:35092] AH02811: stderr from /usr/lib/cgi-bin/luci: script not found or unable to stat
+
+# failJSON: { "time": "2025-07-30T16:43:26", "match": true , "host": "192.0.2.5", "desc": "stderr from a cgi-bin directory, no script name and no trailing slash (gh-4040)" }
+[Wed Jul 30 16:43:26.968908 2025] [cgi:error] [pid 147397:tid 147442] [client 192.0.2.5:33570] AH02811: stderr from /srv/http/cgi-bin: script not found or unable to stat
diff --git a/fail2ban/tests/files/logs/cowrie b/fail2ban/tests/files/logs/cowrie
new file mode 100644
index 00000000..8d79b475
--- /dev/null
+++ b/fail2ban/tests/files/logs/cowrie
@@ -0,0 +1,28 @@
+# Cowrie honeypot JSON log (log.format = json), real-world samples
+
+# failJSON: { "time": "2026-08-13T00:00:34", "match": true, "host": "137.184.154.9" }
+{"session":"2a5e755afa79","protocol":"ssh","src_ip":"137.184.154.9","src_port":37416,"dst_ip":"172.18.0.2","dst_port":2222,"eventid":"cowrie.session.connect","sensor":"580d0186ebeb","uuid":"8c5b1af2-8fc4-11f1-9350-ee70fe9b2de3","timestamp":"2026-08-13T00:00:34.803989Z","message":"New connection: 137.184.154.9:37416 (172.18.0.2:2222) [session: 2a5e755afa79]"}
+
+# not a connect event (client version) -> should not match
+# failJSON: { "match": false }
+{"session":"2a5e755afa79","protocol":"ssh","src_ip":"137.184.154.9","src_port":37416,"dst_ip":"172.18.0.2","dst_port":2222,"version":"SSH-2.0-Go","eventid":"cowrie.client.version","sensor":"580d0186ebeb","uuid":"8c5b1af2-8fc4-11f1-9350-ee70fe9b2de3","timestamp":"2026-08-13T00:00:34.808236Z","message":"Remote SSH version: SSH-2.0-Go"}
+
+# not a connect event (kex, has arrays/nested values) -> should not match
+# failJSON: { "match": false }
+{"session":"2a5e755afa79","protocol":"ssh","src_ip":"137.184.154.9","src_port":37416,"dst_ip":"172.18.0.2","dst_port":2222,"hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"macCS":["hmac-sha2-256-etm@openssh.com"],"compCS":["none"],"langCS":[""],"eventid":"cowrie.client.kex","sensor":"580d0186ebeb","uuid":"8c5b1af2-8fc4-11f1-9350-ee70fe9b2de3","timestamp":"2026-08-13T00:00:34.924330Z","message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397"}
+
+# not a connect event (login success) -> should not match
+# failJSON: { "match": false }
+{"session":"2a5e755afa79","protocol":"ssh","src_ip":"137.184.154.9","src_port":37416,"dst_ip":"172.18.0.2","dst_port":2222,"username":"brun","password":"brun","eventid":"cowrie.login.success","sensor":"580d0186ebeb","uuid":"8c5b1af2-8fc4-11f1-9350-ee70fe9b2de3","timestamp":"2026-08-13T00:00:35.273750Z","message":"login attempt [brun/brun] succeeded"}
+
+# not a connect event (log closed) -> should not match
+# failJSON: { "match": false }
+{"session":"2a5e755afa79","protocol":"ssh","src_ip":"137.184.154.9","src_port":37416,"dst_ip":"172.18.0.2","dst_port":2222,"ttylog":"var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":30,"shasum":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","duplicate":true,"duration_ms":5,"eventid":"cowrie.log.closed","sensor":"580d0186ebeb","uuid":"8c5b1af2-8fc4-11f1-9350-ee70fe9b2de3","timestamp":"2026-08-13T00:00:35.513067Z","message":"Closing TTY Log: var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 after 5 milliseconds"}
+
+# a second, different connect event -> should match
+# failJSON: { "time": "2026-08-13T00:05:00", "match": true, "host": "203.0.113.9" }
+{"session":"9f8e7d6c5b4a","protocol":"telnet","src_ip":"203.0.113.9","src_port":52344,"dst_ip":"172.18.0.2","dst_port":23,"eventid":"cowrie.session.connect","sensor":"580d0186ebeb","uuid":"9f8e7d6c-8fc4-11f1-9350-ee70fe9b2de3","timestamp":"2026-08-13T00:05:00.000000Z","message":"New connection: 203.0.113.9:52344 (172.18.0.2:23) [session: 9f8e7d6c5b4a]"}
+
+# malformed / non-JSON line -> should not match
+# failJSON: { "match": false }
+not a json line at all
diff --git a/fail2ban/tests/files/logs/domino-smtp b/fail2ban/tests/files/logs/domino-smtp
index 957d593f..0e87c52f 100644
--- a/fail2ban/tests/files/logs/domino-smtp
+++ b/fail2ban/tests/files/logs/domino-smtp
@@ -7,6 +7,14 @@
 # failJSON: { "time": "2016-11-07T22:21:20", "match": true , "host": "1.2.3.4" }
 2016-11-07 22:21:20   smtp: postmaster [1.2.3.4] authentication failure using internet password
 
+# failJSON: { "time": "2016-11-07T22:21:21", "match": true , "host": "192.0.2.4", "user": "user with space in name" }
+2016-11-07 22:21:21   smtp: user with space in name [192.0.2.4] authentication failure using internet password
+
+# failJSON: { "time": "2016-11-07T22:21:22", "match": true , "host": "192.0.2.5", "desc": "GHSA-33wh-ccjc-p397, positive case (match, no hangs)" }
+2016-11-07 22:21:22   smtp: A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A 192.0.2.5 authentication failure using internet password
+# failJSON: { "match": false, "desc": "GHSA-33wh-ccjc-p397, negative case (bypass, no hangs)" }
+2016-11-07 22:21:23   smtp: A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A 192.0.2.5
+
 # failJSON: { "time": "2018-09-19T17:25:50", "match": true , "host": "192.0.2.1", "desc":"different log-format" }
 2018-09-19 17:25:50   SMTP Server [0D14:0027-1334] Authentication failed for user Bad Hacker ; connecting host [192.0.2.1]
 # failJSON: { "time": "2018-09-19T17:25:52", "match": true , "host": "192.0.2.2", "desc":"gh-2228, rejected for policy reasons" }
diff --git a/fail2ban/tests/files/logs/dovecot b/fail2ban/tests/files/logs/dovecot
index 07cbd654..da4e2006 100644
--- a/fail2ban/tests/files/logs/dovecot
+++ b/fail2ban/tests/files/logs/dovecot
@@ -144,6 +144,11 @@ Aug 30 00:10:57 auth(info@example.com,192.0.2.110,sasl:login)<CvN+E95Uf4e7eEnj>:
 # failJSON: { "time": "2004-08-30T00:11:05", "match": true , "host": "192.0.2.110", "desc": "closed after 3 attempts (password mismatch), gh-4196" }
 Aug 30 00:11:05 imap-login: Info: Login aborted: Connection closed (auth failed, 3 attempts in 16 secs) (auth_failed): user=<info@example.com>, method=PLAIN, rip=192.0.2.110, lip=0.0.0.0, TLS, session=<CvN+E95Uf4e7eEnj>
 
+# failJSON: { "time": "2004-08-31T16:06:05", "match": true , "host": "192.0.2.111", "desc": "GHSA-33wh-ccjc-p397, positive case (match, no hangs)" }
+Aug 31 16:06:05 s166-62-100-187 dovecot: imap-login: Disconnected: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: (reason: some unknown reason) (tried to use disallowed test auth): user=<>, rip=192.0.2.111
+# failJSON: { "match": false , "desc": "GHSA-33wh-ccjc-p397, negative case (bypass, no hangs)" }
+Aug 31 16:06:06 s166-62-100-187 dovecot: imap-login: Disconnected: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: a: test no match
+
 # ---------------------------------------
 # Test-cases of aggressive mode:
 # ---------------------------------------
diff --git a/fail2ban/tests/files/logs/gitlab b/fail2ban/tests/files/logs/gitlab
index 70ddc0e8..ce68dc4e 100644
--- a/fail2ban/tests/files/logs/gitlab
+++ b/fail2ban/tests/files/logs/gitlab
@@ -3,3 +3,14 @@
 2020-04-09T14:04:00.667Z: Failed Login: username=admin ip=80.10.11.12
 # failJSON: { "time": "2020-04-09T16:15:09", "match": true , "host": "80.10.11.12" }
 2020-04-09T14:15:09.344Z: Failed Login: username=user name ip=80.10.11.12
+
+# Access of unauthorized host in /var/log/gitlab/gitlab-rails/application_json.log
+# filterOptions: [{"logtype": "json"}]
+
+# failJSON: { "time": "2023-08-25T13:25:19", "match": true , "host": "87.250.224.11" }
+{"severity":"INFO","time":"2023-08-25T11:25:19.979Z","correlation_id":"01H8P721YTW1YH5Q7YCSJPVJ5T","meta.caller_id":"SessionsController#new","meta.remote_ip":"87.250.224.11","meta.feature_category":"system_access","meta.client_id":"ip/87.250.224.11","message":"Failed Login: username=admin ip=87.250.224.11"}
+# failJSON: { "time": "2023-08-25T13:31:07", "match": true , "host": "2001:db8::1" }
+{"severity":"INFO","time":"2023-08-25T11:31:07.512Z","correlation_id":"01H8P73ABCDEF1234567890ABCD","meta.caller_id":"SessionsController#new","meta.remote_ip":"2001:db8::1","meta.feature_category":"system_access","meta.client_id":"ip/2001:db8::1","message":"Failed Login: username=git ip=2001:db8::1"}
+# a successful login must not match
+# failJSON: { "match": false }
+{"severity":"INFO","time":"2023-08-25T11:55:10.525Z","correlation_id":"01H8P8RPMVW53W0KWEN2H2DNF4","meta.caller_id":"SessionsController#create","meta.remote_ip":"203.0.113.9","meta.feature_category":"system_access","meta.user":"admin","meta.user_id":2,"meta.client_id":"user/2","message":"Successful Login: username=admin ip=203.0.113.9 method=standard admin=true"}
diff --git a/fail2ban/tests/files/logs/nginx-botsearch b/fail2ban/tests/files/logs/nginx-botsearch
index c694fa3b..a739dc84 100644
--- a/fail2ban/tests/files/logs/nginx-botsearch
+++ b/fail2ban/tests/files/logs/nginx-botsearch
@@ -32,4 +32,12 @@
 2015/01/21 10:58:10 [error] 2833#0: *16336 open() "/var/www/site/cgi-bin/php4" failed (2: No such file or directory), client: 5.7.9.2, server: localhost, request: "HEAD /cgi-bin/php4 HTTP/1.1", host: "1.2.3.4"
 
 # failJSON: { "time": "2015-01-21T15:02:27", "match": true , "host": "5.7.9.2" }
-2015/01/21 15:02:27 [error] 2833#0: *16813 "/var/www/site/roundcube/" is not found (2: No such file or directory), client: 5.7.9.2, server: localhost, request: "GET /roundcube/ HTTP/1.1", host: "1.2.3.4"
\ No newline at end of file
+2015/01/21 15:02:27 [error] 2833#0: *16813 "/var/www/site/roundcube/" is not found (2: No such file or directory), client: 5.7.9.2, server: localhost, request: "GET /roundcube/ HTTP/1.1", host: "1.2.3.4"
+
+# filterOptions: [{"logtype": "journal"}]
+
+# failJSON: { "match": true, "host": "5.7.9.2", "desc": "systemd journal message, gh-3732" }
+host nginx[2833]: 2015/01/21 10:56:10 [error] 2833#0: *16336 open() "/var/www/site/cgi-bin/php4" failed (2: No such file or directory), client: 5.7.9.2, server: localhost, request: "GET /cgi-bin/php4 HTTP/1.1", host: "1.2.3.4"
+
+# failJSON: { "match": true, "host": "5.7.9.2", "desc": "systemd journal message, is not found variant, gh-3732" }
+host nginx[2833]: 2015/01/21 15:02:27 [error] 2833#0: *16813 "/var/www/site/roundcube/" is not found (2: No such file or directory), client: 5.7.9.2, server: localhost, request: "GET /roundcube/ HTTP/1.1", host: "1.2.3.4"
diff --git a/fail2ban/tests/files/logs/postfix b/fail2ban/tests/files/logs/postfix
index 30a4df24..0075b91c 100644
--- a/fail2ban/tests/files/logs/postfix
+++ b/fail2ban/tests/files/logs/postfix
@@ -154,6 +154,9 @@ Jan 14 16:18:16 xxx postfix/smtpd[14933]: warning: host[192.0.2.5]: SASL CRAM-MD
 # failJSON: { "time": "2004-11-04T09:11:01", "match": true , "host": "192.0.2.152", "user": "admin", "desc": "reason unavailable" }
 Nov  4 09:11:01 mail postfix/smtpd[1234]: warning: unknown[192.0.2.152]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=admin
 
+# failJSON: { "match": true , "host": "192.0.2.44", "desc": "hostname does not resolve to address, aggressive only (gh-4078)" }
+Aug 14 10:00:01 mail postfix/smtpd[1234]: warning: hostname bad.example.com does not resolve to address 192.0.2.44: Name or service not known
+
 # ---------------------------------------
 # Test-cases of postfix DDOS mode:
 # ---------------------------------------
diff --git a/fail2ban/tests/files/logs/sshd b/fail2ban/tests/files/logs/sshd
index 1a50d49f..961cd79e 100644
--- a/fail2ban/tests/files/logs/sshd
+++ b/fail2ban/tests/files/logs/sshd
@@ -414,4 +414,11 @@ Nov 26 16:47:51 srv sshd[19320]: Disconnected from authenticating user root 192.
 # failJSON: { "time": "2019-07-08T23:40:17", "match": true , "host": "192.0.2.2", "desc": "RFC 5424 format with extra data and brackets in value (gh-2309)" }
 <38>1 2019-07-08T17:40:17.954167-04:00 hostname.example.com sshd 55555 - [timeQuality tzKnown="1" isSynced="0"][xxx@123 test="[brackets]"] Failed unknown for invalid user redmond from 192.0.2.2 port 55555 ssh2
 
+# failJSON: { "match": false , "desc": "RFC 5424 format, injection attempt on STRUCTURED-DATA field (GHSA-c2mg-2r7g-c3wp)" }
+<38>1 2019-07-08T17:40:17.954169-04:00 hostname.example.com sshd 12345 123 [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+# failJSON: { "match": false , "desc": "RFC 5424 format, injection attempt on STRUCTURED-DATA 2nd field (GHSA-c2mg-2r7g-c3wp)" }
+<38>1 2019-07-08T17:40:17.954170-04:00 hostname.example.com sshd 12345 123 [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA][BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
+# failJSON: { "match": false , "desc": "RFC 5424 format, injection attempt on STRUCTURED-DATA, unescaped new-line in PARAM-VALUE (GHSA-c2mg-2r7g-c3wp)" }
+<38>1 2019-07-08T17:40:17.954171-04:00 hostname.example.com sshd 12345 123 [AAAAAAAAAAAAAAAAAAAAAAAAAA XXX="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+
 # addFILE: "sshd-journal"
diff --git a/fail2ban/tests/sockettestcase.py b/fail2ban/tests/sockettestcase.py
index 5c674620..e24d110a 100644
--- a/fail2ban/tests/sockettestcase.py
+++ b/fail2ban/tests/sockettestcase.py
@@ -25,6 +25,7 @@ __copyright__ = "Copyright (c) 2013 Steven Hiscocks"
 __license__ = "GPL"
 
 import os
+import socket
 import sys
 import tempfile
 import threading
@@ -34,6 +35,7 @@ import unittest
 from .utils import LogCaptureTestCase
 
 from .. import protocol
+from ..server import asyncserver
 from ..server.asyncserver import asyncore, RequestHandler, loop, AsyncServer, AsyncServerException
 from ..server.utils import Utils
 from ..client.csocket import CSocket
@@ -203,6 +205,44 @@ class Socket(LogCaptureTestCase):
 		self.assertLogged("Server connection was closed: test errors in poll",
 			"Too many errors - stop logging connection errors", all=True)
 
+	def testSocketActivation(self):
+		# Simulate a socket already bound/listening, handed to us as an
+		# inherited fd (systemd socket activation, sd_listen_fds(3)):
+		presock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+		presock.bind(self.sock_name)
+		presock.listen(5)
+		# dup to a fresh fd first (presock.fileno() might already be 3):
+		fd = os.dup(presock.fileno())
+		# keep backup fd to allow for shutdown test
+		self.addCleanup(os.close, fd)
+		presock.close()
+		os.dup2(fd, 3)
+
+		self.addCleanup(os.environ.pop, "LISTEN_PID", None)
+		self.addCleanup(os.environ.pop, "LISTEN_FDS", None)
+		self.addCleanup(lambda: os.path.exists(self.sock_name) and os.remove(self.sock_name))
+		os.environ["LISTEN_PID"] = str(os.getpid())
+		os.environ["LISTEN_FDS"] = "1"
+
+		serverThread = self._createServerThread()
+		# consumed once picked up, so forked actions don't misinterpret them:
+		self.assertNotIn("LISTEN_PID", os.environ)
+		self.assertNotIn("LISTEN_FDS", os.environ)
+
+		client = Utils.wait_for(self._serverSocket, 2)
+		testMessage = ["A", "test", "message"]
+		self.assertEqual(client.send(testMessage), testMessage)
+
+		self.server.stop()
+		self._stopServerThread()
+		self.assertFalse(serverThread.is_alive())
+		# socket file is owned by the service manager, must not be removed:
+		self.assertTrue(os.path.exists(self.sock_name))
+
+		# socket is owned by the service manager, must not be shut down:
+		with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as csock:
+			csock.connect(self.sock_name)
+
 	def testSocketForce(self):
 		open(self.sock_name, 'w').close() # Create sock file
 		# Try to start without force
diff --git a/fail2ban/version.py b/fail2ban/version.py
index 34dff834..f570d0bc 100644
--- a/fail2ban/version.py
+++ b/fail2ban/version.py
@@ -24,7 +24,7 @@ __author__ = "Cyril Jaquier, Yaroslav Halchenko, Steven Hiscocks, Daniel Black"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2005-2016 Yaroslav Halchenko, 2013-2014 Steven Hiscocks, Daniel Black"
 __license__ = "GPL-v2+"
 
-version = "1.1.1.dev1"
+version = "1.1.2.dev1"
 
 def normVersion():
   """ Returns fail2ban version in normalized machine-readable format"""
diff --git a/files/fail2ban.service.in b/files/fail2ban.service.in
index e93fd596..7210bed3 100644
--- a/files/fail2ban.service.in
+++ b/files/fail2ban.service.in
@@ -8,6 +8,8 @@ PartOf=iptables.service firewalld.service ip6tables.service ipset.service nftabl
 Type=simple
 Environment="PYTHONNOUSERSITE=1"
 RuntimeDirectory=fail2ban
+# prevents socket created by fail2ban.socket from being removed
+RuntimeDirectoryPreserve=yes
 StateDirectory=fail2ban
 ExecStart=@BINDIR@/fail2ban-server -xf start
 # if should be logged in systemd journal, use following line or set logtarget to sysout in fail2ban.local
diff --git a/files/fail2ban.socket.in b/files/fail2ban.socket.in
new file mode 100644
index 00000000..2333f84f
--- /dev/null
+++ b/files/fail2ban.socket.in
@@ -0,0 +1,12 @@
+[Unit]
+Description=Fail2Ban Socket
+Documentation=man:fail2ban(1)
+
+[Socket]
+ListenStream=%t/fail2ban/fail2ban.sock
+FileDescriptorName=fail2ban
+SocketMode=0600
+RuntimeDirectory=fail2ban
+
+[Install]
+WantedBy=sockets.target
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 9d270933..5cf9c4fb 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH FAIL2BAN-CLIENT "1" "April 2024" "Fail2Ban v1.1.1.dev1" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "August 2026" "Fail2Ban v1.1.2.dev1" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH SYNOPSIS
 .B fail2ban-client
 [\fI\,OPTIONS\/\fR] \fI\,<COMMAND>\/\fR
 .SH DESCRIPTION
-Fail2Ban v1.1.1.dev1 reads log file that contains password failure report
+Fail2Ban v1.1.2.dev1 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
@@ -125,8 +125,10 @@ server
 .TP
 \fBstatus \fB\-\-all\fR [FLAVOR]\fR
 gets the current status of all
-jails, with optional output style [FLAVOR].
-Flavors: 'basic' (default), 'cymru', 'short', 'stats'.
+jails, with optional output style
+[FLAVOR]. Flavors: 'basic'
+(default), 'cymru', 'short',
+\&'stats'
 .TP
 \fBstat[istic]s\fR
 gets the current statistics of all
@@ -214,9 +216,11 @@ stops the jail <JAIL>. The jail is
 removed
 .TP
 \fBstatus <JAIL> [FLAVOR]\fR
-gets the current status of all
-jails, with optional output style [FLAVOR].
-Flavors: 'basic' (default), 'cymru', 'short', 'stats'.
+gets the current status of <JAIL>,
+with optional output style
+[FLAVOR]. Flavors: 'basic'
+(default), 'cymru', 'short',
+\&'stats'
 .IP
 JAIL CONFIGURATION
 .TP
diff --git a/man/fail2ban-python.1 b/man/fail2ban-python.1
index e673d7a0..d1dff5b1 100644
--- a/man/fail2ban-python.1
+++ b/man/fail2ban-python.1
@@ -1,13 +1,13 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH FAIL2BAN-PYTHON "1" "April 2024" "fail2ban-python 1.1.1.1" "User Commands"
+.TH FAIL2BAN-PYTHON "1" "August 2026" "fail2ban-python 1.1.2.1" "User Commands"
 .SH NAME
 fail2ban-python \- a helper for Fail2Ban to assure that the same Python is used
 .SH DESCRIPTION
 usage: fail2ban\-python [option] ... [\-c cmd | \fB\-m\fR mod | file | \fB\-]\fR [arg] ...
 Options (and corresponding environment variables):
-\fB\-b\fR     : issue warnings about str(bytes_instance), str(bytearray_instance)
+\fB\-b\fR     : issue warnings about converting bytes/bytearray to str and comparing
 .IP
-and comparing bytes/bytearray with str. (\fB\-bb\fR: issue errors)
+bytes/bytearray with str or bytes with int. (\fB\-bb\fR: issue errors)
 .PP
 \fB\-B\fR     : don't write .pyc files on import; also PYTHONDONTWRITEBYTECODE=x
 \fB\-c\fR cmd : program passed in as string (terminates option list)
@@ -21,7 +21,7 @@ debug builds); also PYTHONDEBUG=x
 .IP
 if stdin does not appear to be a terminal; also PYTHONINSPECT=x
 .PP
-\fB\-I\fR     : isolate Python from the user's environment (implies \fB\-E\fR and \fB\-s\fR)
+\fB\-I\fR     : isolate Python from the user's environment (implies \fB\-E\fR, \fB\-P\fR and \fB\-s\fR)
 \fB\-m\fR mod : run library module as a script (terminates option list)
 \fB\-O\fR     : remove assert and __debug__\-dependent statements; add .opt\-1 before
 .IP
@@ -31,9 +31,12 @@ if stdin does not appear to be a terminal; also PYTHONINSPECT=x
 .IP
 \&.pyc extension
 .PP
-\fB\-P\fR     : don't prepend a potentially unsafe path to sys.path
+\fB\-P\fR     : don't prepend a potentially unsafe path to sys.path; also
+.IP
+PYTHONSAFEPATH
+.PP
 \fB\-q\fR     : don't print version and copyright messages on interactive startup
-\fB\-s\fR     : don't add user site directory to sys.path; also PYTHONNOUSERSITE
+\fB\-s\fR     : don't add user site directory to sys.path; also PYTHONNOUSERSITE=x
 \fB\-S\fR     : don't imply 'import site' on initialization
 \fB\-u\fR     : force the stdout and stderr streams to be unbuffered;
 .IP
@@ -57,9 +60,10 @@ also PYTHONWARNINGS=arg
 .IP
 control how Python invalidates hash\-based .pyc files
 .PP
-\fB\-\-help\-env\fR      : print help about Python environment variables and exit
-\fB\-\-help\-xoptions\fR : print help about implementation\-specific \fB\-X\fR options and exit
-\fB\-\-help\-all\fR      : print complete help information and exit
+\fB\-\-help\-env\fR: print help about Python environment variables and exit
+\fB\-\-help\-xoptions\fR: print help about implementation\-specific \fB\-X\fR options and exit
+\fB\-\-help\-all\fR: print complete help information and exit
+.PP
 Arguments:
 file   : program read from script file
 \-      : program read from stdin (default; interactive mode if a tty)
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index d1a7626f..6b879e3f 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH FAIL2BAN-REGEX "1" "June 2025" "fail2ban-regex 1.1.1.dev1" "User Commands"
+.TH FAIL2BAN-REGEX "1" "August 2026" "fail2ban-regex 1.1.2.dev1" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index df85419b..af824fd7 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH FAIL2BAN-SERVER "1" "April 2024" "Fail2Ban v1.1.1.dev1" "User Commands"
+.TH FAIL2BAN-SERVER "1" "August 2026" "Fail2Ban v1.1.2.dev1" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fI\,OPTIONS\/\fR]
 .SH DESCRIPTION
-Fail2Ban v1.1.1.dev1 reads log file that contains password failure report
+Fail2Ban v1.1.2.dev1 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
diff --git a/man/fail2ban-testcases.1 b/man/fail2ban-testcases.1
index 8d8dcf6e..c2ad982d 100644
--- a/man/fail2ban-testcases.1
+++ b/man/fail2ban-testcases.1
@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH FAIL2BAN-TESTCASES "1" "April 2024" "fail2ban-testcases 1.1.1.dev1" "User Commands"
+.TH FAIL2BAN-TESTCASES "1" "August 2026" "fail2ban-testcases 1.1.2.dev1" "User Commands"
 .SH NAME
 fail2ban-testcases \- run Fail2Ban unit-tests
 .SH SYNOPSIS
diff --git a/setup.py b/setup.py
index b2c0e5c9..ee8f392d 100755
--- a/setup.py
+++ b/setup.py
@@ -80,7 +80,7 @@ class install_scripts_f2b(install_scripts):
 		except: # pragma: no cover
 			print('WARNING: Cannot find root-base option, check the bin-path to fail2ban-scripts in "fail2ban.service" and "fail2ban-openrc.init".')
 
-		scripts = ['fail2ban.service', 'fail2ban-openrc.init']
+		scripts = ['fail2ban.service', 'fail2ban.socket', 'fail2ban-openrc.init']
 		for script in scripts:
 			print(('Creating %s/%s (from %s.in): @BINDIR@ -> %s' % (buildroot, script, script, install_dir)))
 			with open(os.path.join(source_dir, 'files/%s.in' % script), 'r') as fn:
@@ -294,5 +294,6 @@ if sys.argv[1] == "install":
 	print("They are in \"/etc/fail2ban/\".")
 	print("")
 	print("You can also install systemd service-unit file from \"build/fail2ban.service\"")
+	print("(optionally paired with \"build/fail2ban.socket\" to enable socket activation)")
 	print("resp. corresponding init script from \"files/*-initd\".")
 	print("")