# fail2ban versions and changelog

> The latest fail2ban version is 1.1.1. Check your installed version, see what changed in 1.1.1, which version each distro ships, and how to upgrade safely.
>
> Source: https://fail2ban.dev/versions/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

The latest fail2ban version is **1.1.1** ("triple-one-win"), released on 2026-08-15. Check the version you have with `fail2ban-client --version`. Most distributions ship older releases: Ubuntu 24.04 LTS and Debian 12 have 1.0.2, Debian 13 and EPEL 9/10 have 1.1.0, and Debian testing/sid has 1.1.1. fail2ban 1.1.x needs Python 3.5 or newer.

```text
$ sudo fail2ban-client --version
Fail2Ban v1.1.1
```

```bash
fail2ban-client -V               # short, machine-readable
sudo fail2ban-client version     # asks the running server
```

Package managers show the installed and available versions:


#### Debian / Ubuntu
```bash
```
```bash
```
```bash
```

| Distribution | fail2ban version |
|---|---|
| Ubuntu 26.04 LTS (resolute) | 1.1.0 |
| Ubuntu 25.10 | 1.1.0 |
| Ubuntu 24.04 LTS | 1.0.2 |
| Ubuntu 22.04 LTS | 0.11.2 |
| Ubuntu 20.04 LTS | 0.11.1 |
| Debian testing / sid | 1.1.1 |
| Debian 13 (trixie) | 1.1.0 |
| Debian 12 (bookworm) | 1.0.2 |
| Debian 11 (bullseye) | 0.11.2 |
| Fedora | 1.1.0 |
| EPEL 9 and 10 (RHEL, Rocky, AlmaLinux) | 1.1.0 |
| EPEL 8 | 1.0.2 |

Distributions backport security fixes into their own package versions, so `1.0.2-3ubuntu0.1` on Ubuntu 24.04 is not the same as upstream 1.0.2. Install guides: [Ubuntu](/install/ubuntu/), [Debian](/install/debian/), [RHEL family](/install/rhel/).

## What's new in fail2ban 1.1.1

The highlights for administrators:

- **Default ban action moved to `paths-*.conf`.** The stock config now uses nftables on Debian, Fedora, Arch and openSUSE and `pf` on FreeBSD and macOS. Override it in `jail.local` as before.
- **Debian paths switch sshd and postfix to the systemd backend.**
- **sshd filter** matches the `sshd-session` process name used since OpenSSH 9.8.
- **Automatic journal fallback:** with `backend = auto`, a jail whose `logpath` finds no file but whose filter has a `journalmatch` switches to `systemd` (`systemd_if_nologs`, on by default). New `skip_if_nologs` lets fail2ban start with a jail skipped instead of failing.
- **systemd backend `rotated` option** (default off) to cut the number of open journal files.
- **`ignoreip` accepts `file:/path`** lists, also for `addignoreip`.
- **systemd socket activation** with an optional `fail2ban.socket` unit.
- **iptables action rewritten** to support several chains (`chain = INPUT,FORWARD`); custom actions based on it may need updating.
- **nftables sets accept CIDR ranges** (`flags interval`), so subnet bans work.
- New filters and jails for **Vaultwarden, OpenVPN and XRDP**; Dovecot 2.4 and Proxmox web GUI support.
- **Security fix:** catastrophic regex backtracking in the `domino-smtp` and `dovecot` filters ([GHSA-33wh-ccjc-p397](/security/)).
- `exim` filter: risky rules moved from `normal` to a new `more` mode.

The full upstream changelog for 1.1.1:



## What changed in 1.1.0

1.1.0 (2024-04-25) set the minimum to **Python 3.5**, added support for Python 3.12 and 3.13, and added `fail2ban-client status --all` and `fail2ban-client stats`. `fail2ban-regex` started preferring a *jail* when given a bare name, so `fail2ban-regex … sshd` loads the jail's settings; use `sshd.conf` or `filter.d/sshd` to load only the filter. IPv6 detection became automatic (`allowipv6 = auto`).

## fail2ban release history



The 0.11 branch introduced incremental ban times (`bantime.increment`); 0.10 added IPv6 support. Both are out of upstream maintenance — distributions still on them (Ubuntu 22.04, Debian 11) patch only security issues.

## Python version requirements

| fail2ban | Python |
|---|---|
| 1.1.0, 1.1.1 | 3.5 or newer (3.12 and 3.13 supported) |
| 1.0.1, 1.0.2 | 2.7 or 3.x |
| 0.11.x and older | 2.6+/2.7 or 3.x |

fail2ban has no required third-party Python modules. Optional ones: `pyinotify` (inotify backend), `python3-systemd` (journal backend), `dnspython` (cymru status flavor). On Python 3.12+, fail2ban bundles the removed `asyncore`/`asynchat` modules.

## Upgrade fail2ban

Before any upgrade, back up your local files and note the current version:

```bash
fail2ban-client --version
```

```bash
sudo dnf upgrade fail2ban                                     # Fedora/EPEL
```

### Newer than your distribution: upstream .deb

The 1.1.1 GitHub release includes a Debian package, `fail2ban_1.1.1-1.upstream2_all.deb`. On Debian or Ubuntu:

```bash
sudo apt install ./fail2ban_1.1.1-1.upstream2_all.deb
```

### From source (git)

```bash
cd fail2ban
git checkout 1.1.1
sudo python3 setup.py install
```

### After upgrading

```bash
sudo systemctl restart fail2ban
sudo fail2ban-client version
```

## Upgrading from 0.x to 1.x: compatibility notes

- **Keep your changes in `.local` files.** If you edited `jail.conf` or stock filters, move the changes to `jail.local` and `filter.d/*.local` before upgrading — the upgrade replaces the `.conf` files.
- **1.0.1:** option parsing for `backend`, `filter` and `action` became strict, so partially wrong values now raise an error instead of being ignored. The `mail-whois` fix for CVE-2021-32749 may need extra configuration with some mailers.
- **0.11 → 1.x:** actions that used `<ip>` to get a failure ID may need `<fid>` or `<F-ID>`; custom actions must fail cleanly in `actionban`/`actionunban` when their environment is broken.
- **1.1.0:** Python 2 is no longer supported.
- **1.1.1:** custom actions that include `iptables.conf` may need tag changes (`<chain>` → `$chain`); the `exim` filter's `normal` mode is narrower; default `banaction` comes from `paths-*.conf`, so a `banaction` set in `jail.local` still wins.

Test with `sudo fail2ban-client -t` after every upgrade, and read [security advisories](/security/) to see which fixes your version has.

## FAQ

### What is the latest version of fail2ban?

fail2ban 1.1.1, released on 2026-08-15 with the name "triple-one-win". The previous release was 1.1.0 from 2024-04-25. Development continues on the master branch as 1.1.2-dev. Releases are published on GitHub at github.com/fail2ban/fail2ban/releases.

### How do I check my fail2ban version?

Run `fail2ban-client --version`, which prints something like `Fail2Ban v1.1.1`. `sudo fail2ban-client version` asks the running server instead. Your package manager also shows it: `apt policy fail2ban` on Debian and Ubuntu, `dnf info fail2ban` on Fedora and RHEL-based systems.

### Which fail2ban version does Ubuntu 24.04 have?

Ubuntu 24.04 LTS ships fail2ban 1.0.2 (package `1.0.2-3ubuntu0.1`), configured with nftables and the systemd backend by default. It lacks 1.1.x features like `status --all`, `stats` and `ignoreip` file lists. Ubuntu 25.10 and 26.04 LTS ship 1.1.0.

### What Python version does fail2ban need?

fail2ban 1.1.0 and 1.1.1 need Python 3.5 or newer and support Python up to 3.13. fail2ban 1.0.x was the last line that also ran on Python 2.7. Optional modules are pyinotify, python3-systemd and dnspython.

### How do I upgrade fail2ban to the latest version?

Use your package manager first: `sudo apt install --only-upgrade fail2ban` or `sudo dnf upgrade fail2ban`. For a newer release than your distribution offers, install the `.deb` from the GitHub release or build from source with `git checkout 1.1.1` and `sudo python3 setup.py install`. Back up `/etc/fail2ban` and run `fail2ban-client -t` afterwards.