diff --git a/tests/bug-7851-01/README.md b/tests/bug-7851-01/README.md
new file mode 100644
index 000000000..ab6eb9018
--- /dev/null
+++ b/tests/bug-7851-01/README.md
@@ -0,0 +1,3 @@
+https://redmine.openinfosecfoundation.org/issues/7851
+
+PCAP generated based on the example traffic in the ticket.
diff --git a/tests/bug-7851-01/connect.fs b/tests/bug-7851-01/connect.fs
new file mode 100644
index 000000000..ec944dcfa
--- /dev/null
+++ b/tests/bug-7851-01/connect.fs
@@ -0,0 +1,3 @@
+flow default tcp 192.168.0.233:44123 > google.com:80 (tcp.initialize;);
+default > (content:"CONNECT / HTTP/1.1\x0d\x0aMp-Country: US\x0d\x0aMp-BuildVersion: 136\x0d\x0aMp-Roaming: 0\x0d\x0aMp-VersionRelease: 4.3\x0d\x0aMp-Operator: android\x0d\x0aMp-SdkId: 18\x0d\x0aMp-NetworkType: 3\x0d\x0a\x0d\x0a";);
+default < (content:"HTTP/1.1 200 OK\x0d\x0a\x0d\x0a";);
diff --git a/tests/bug-7851-01/connect.pcap b/tests/bug-7851-01/connect.pcap
new file mode 100644
index 000000000..8d85b1c61
Binary files /dev/null and b/tests/bug-7851-01/connect.pcap differ
diff --git a/tests/bug-7851-01/test.rules b/tests/bug-7851-01/test.rules
new file mode 100644
index 000000000..6cf2d4193
--- /dev/null
+++ b/tests/bug-7851-01/test.rules
@@ -0,0 +1,6 @@
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Suspicious short host value - pcre and bsize"; flow:established,to_server; http.host; bsize:<3; pcre:"/^.{1,2}$/"; classtype:bad-unknown; sid:1; rev:1;)
+
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Suspicious short host value - bsize"; flow:established,to_server; http.host; bsize:<3; classtype:bad-unknown; sid:2; rev:1;)
+
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Suspicious short host value - pcre"; flow:established,to_server; http.host; pcre:"/^.{1,2}$/"; classtype:bad-unknown; sid:3; rev:1;)
+
diff --git a/tests/bug-7851-01/test.yaml b/tests/bug-7851-01/test.yaml
new file mode 100644
index 000000000..e8603aee2
--- /dev/null
+++ b/tests/bug-7851-01/test.yaml
@@ -0,0 +1,11 @@
+checks:
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+  - filter:
+      count: 1
+      match:
+        event_type: http
+        http.http_method: CONNECT
+        http.url: /