---
type: Addressed
product: PAN-OS
version: 11.0.3
---

## PAN-231823

A fix was made to address CVE-2024-5916.

## PAN-233954

Fixed an issue where the firewall was unable to retrieve correct groups from the LDAP server.

## PAN-232059

Fixed an issue with memory management when processing large certificates using TLSv1.3.

## PAN-229691

Fixed an issue on Panorama where configuration lock timeout errors were observed during normal operational commands by increasing thread stack size on Panorama.

## PAN-228877

```caveat
PA-7050 firewalls only
```

Fixed an issue with OOM conditions which caused slot restarts
due to pan_cmd consuming more than 300
MB.

## PAN-227639

Fixed an issue where the ACC displayed an incorrect DNS-base application traffic byte count.

## PAN-227376

Fixed an issue where a memory overrun caused the all_task process to stop responding.

## PAN-227179

Fixed an issue where routes were not updated in the forwarding table.

## PAN-226418

A CLI command was added to address an issue where long-lived sessions aged out even when there was ongoing traffic.

## PAN-226198

Fixed an issue on Panorama where the configd process repeatedly restarted when attempting to make configuration changes.

## PAN-225920

Fixed an issue where duplicate predict sessions didn't release NAT resources.

## PAN-225183

Fixed an issue where SSH tunnels were unstable due to ciphers used as part of the high availability SSH configuration.

## PAN-225169

Added a CLI command to view Cortex Data Lake queue usage.

## PAN-224145

Fixed an issue in multi-vsys environments where, when Panorama was on a PAN-OS 10.2 release and the firewall was on a PAN-OS 10.1 release, commits failed on the firewall when inbound inspection mode was configured in the decryption policy rule.

## PAN-223852

Fixed an issue where all_pktproc stopped responding when network packet broker or decryption broker chains failed.

## PAN-223741

Fixed an issue where the mprelay process stopped responding, which caused a slot restart when another slot rebooted.

## PAN-223501

```caveat
PA-5200 Series and PA-7000 Series firewalls only
```

Fixed an issue where diagnostic information for the dataplane in the dp-monitor.log file was not complete.

## PAN-223488

Fixed an issue where closed ElasticSearch shards were not deleted, which resulted in shard
purging not working as expected.

## PAN-223457

Fixed an issue where, if the number of group queries exceeded the Okta rate limit threshold, the firewall cleared the cache for the groups.

## PAN-223317

Fixed an issue where SSL traffic failed with the error message: Error: General TLS protocol error.

## PAN-223185

Fixed an issue where the distributord process stopped responding.

## PAN-222957

Fixed an issue where managed firewalls did not reflect changes pushed by users who were not in a
superuser role.

## PAN-222941

Fixed an issue where viewing the latest logs took longer than expected due to log indexer failures.

## PAN-222533

```caveat
VM-Series firewalls on Microsoft Azure and Amazon Web Services (AWS) environments
```

Added support for high availability (HA) link monitoring and path monitoring.

## PAN-222418

Fixed an issue where the firewall intermittently recorded a reconnection message to the authentication server as an error, even if no disconnection occurred.

## PAN-222162

Fixed an issue where the show transceiver <interface> CLI command
showed the RX and TX powers as 0.00 mW.

## PAN-221984

```caveat
VM-Series firewalls in Microsoft Azure environments only
```

Fixed an issue where an interface went down after a hotplug event and was only recoverable by restarting the firewall.

## PAN-221836

Fixed an issue where improper SNI detection caused incorrect URL categorization.

## PAN-221787

Fixed an issue where a User Principal Name (UPN) was incorrectly required in the pre-logon machine certificate.

## PAN-221647

Fixed an issue where the Apps seen value was not reflected on Panorama.

## PAN-221577

Fixed an issue where a static route for a branch or hub over the respective virtual interface was not installed in the routing table even when the tunnel to the branch or hub was active.

## PAN-221208

Fixed an issue where the tunnel monitor was unable to remain up when zone protection with Strict
IP was enabled and NAT Traversal was applied.

## PAN-221126

Fixed an issue where Email server profiles (Device > Server Profiles > Email and
Panorama > Server Profiles > Email) to forward
logs as email notifications were not forwarded in a readable
format.

## PAN-220910

Fixed an issue where an internal management plane NIC caused a kernel panic when doing a transmit due to the driver reinitializing under certain failure or change conditions on the same interface during transmit.

## PAN-220899

Fixed an issue where you were unable to choose the manual GlobalProtect gateway.

## PAN-220747

Fixed an issue where logs were not visible after restarting the log collector.

## PAN-220626

Fixed an issue where system warning logs were written every 24 hours.

## PAN-220448

Fixed an issue where the GlobalProtect client connection remained at the prelogin stage when
Kerberos SSO failed and was unable to fall back to the realm
authentication.

## PAN-220401

Fixed an issue where, during a reboot, an unexpected error message was displayed that the syslog configuration file format was too old.

## PAN-220281

```caveat
PA-7080 firewalls only
```

Fixed an issue where autocommitting changes after rebooting the
Log Forwarding Card (LFC) caused the logrcvr process to
fail to read the configuration file.

## PAN-220180

Fixed an issue where configured botnet reports (Monitor > Botnet) were not generated.

## PAN-219813

Fixed an issue where the configuration log displayed incorrect information after a multidevice
group Validate-all operation.

## PAN-219659

Fixed an issue where root partition frequently filled up and the following error message was displayed: Disk usage for / exceeds limit, xx percent in use, cleaning filesystem.

## PAN-219644

Fixed an issue where firewalls that forwarded logs to a syslog server over TLS (Objects > Log Forwarding) used the default Palo Alto Networks certificate instead of the configured custom certificate.

## PAN-219623

Fixed an issue where, when a multidynamic group validate job was pushed on the firewall, logs
displayed Panorama push instead of
ValidateAll push.

## PAN-219498

Fixed an issue where the Threat ID/Name detail in Threat logs was not
included in syslog messages sent to Splunk.

## PAN-219300

Fixed an issue where the task manager displayed only limited data.

## PAN-219253

Fixed an issue where, after making changes in a template, the Commit and Push option was grayed out.

## PAN-218988

Fixed an issue in FIPS mode where, when importing a certificate with a new private key, and the certificate used the name of an existing certificate on the Panorama, the following error message was displayed: Mismatched public and private keys.

## PAN-218947

Fixed an issue where logs were not displayed in Elasticsearch under ingestion load.

## PAN-218697

Fixed an issue where the ElasticSearch status frequently changed to red or yellow after a PAN-OS upgrade.

## PAN-218663

A fix was made to address CVE-2024-2433

## PAN-218404

Fixed an issue where ikemgr stopped responding due to receiving CREATE_CHILD messages with a malformed SA payload.

## PAN-218340

Fixed an issue where selective pushes to template stack and multi device group pushes caused a buildup of resident memory, which caused the configd process to stop responding.

## PAN-218318

Fixed an issue where the firewall changed the time zone automatically instead of retrieving the correct time zone from the NTP server.

## PAN-218273

Fixed an issue where TCP keepalive packets from the client to the server weren't forwarded when SSL decryption was enabled.

## PAN-218267

Fixed an issue where a commit and push operation from Panorama to managed firewalls did not complete or took longer to complete than expected.

## PAN-218252

Fixed an issue where the slot-1 data processor showed the status as down during an SNMP
query.

## PAN-218107

Fixed an issue with ciphers used for SSH tunnels where packet lengths were too large, which made the SSH tunnel unstable.

## PAN-218046

Fixed an issue where the Virtual Routers (Network > Virtual Routers) setting was not available when configuring a custom admin role (Device > Admin Roles).

## PAN-218001

```caveat
PA-400 Series firewalls only
```

Fixed an issue where shutdown commands rebooted the system instead of correctly triggering a shutdown.

## PAN-217650

```caveat
VM-Series firewalls and Panorama virtual appliances in Microsoft Azure environments only
```

Fixed an issue where management interface
Speed/Duplex was reported as unknown.

## PAN-217493

Fixed an issue where superusers with read-only privileges were unable to view SCEP object configurations.

## PAN-217169

Fixed an issue where the logrcvr stopped forwarding logs to the syslog server after a restart.

## PAN-217053

Fixed an issue where the configd process stopped responding after a selective push to multiple device groups failed.

## PAN-216957

Fixed an issue where allow list checks in an authentication profile did not work if the group
Distinguished Name contains the ampersand ( & ) character.

## PAN-216775

Fixed an issue where the devsrvr process stopped responding at pan_cloud_agent_get_curl_connection() and the URL cloud could not be connected.

## PAN-216366

Fixed an issue where, when custom signatures used a certain syntax, false positives were generated on devices on a PAN-OS 10.0 release.

## PAN-216214

```caveat
Panorama managed firewalls in active/active HA configurations only
```

Fixed an issue where the HA status displayed as Out of Sync (Panorama > Managed Devices > Health) if local firewall configurations were made on one of the HA peers. This caused the next HA configuration sync to overwrite the local firewall configuration made on the HA peer.

## PAN-216048

Fixed an issue where, when upgrading from a PAN-OS 9.1 release to a PAN-OS 10.0 release, commits failed with the error message: hip profiles unexpected here.

## PAN-215767

Fixed an issue where, after a high availability failover, IKE SA negotiation failed with the error message INVALID_SPI, which resulted in temporary loss of traffic over some proxy IDs.

## PAN-215655

Fixed an issue where, after a multidynamic group push, Security policy rules with the target
device tag were added to a firewall that did not have the tag.

## PAN-215338

```caveat
PA-5400 Series firewalls only
```

Fixed an issue where the inner VLAN tag for Q-in-Q traffic was stripped when forwarding.

## PAN-215317

Fixed an issue where the dataplane stopped responding unexpectedly with the error message comm exited with signal of 10.

## PAN-215066

Fixed an issue on Panorama where push scope rendering caused the Commit and Push or Push to Devices operation window to hang for several minutes.

## PAN-214990

Fixed an issue where firewall copper ports flapped intermittently when device telemetry was enabled.

## PAN-214987

Fixed an issue where Application Filter names were not random, and they matched or included internal protocol names.

## PAN-214815

Fixed an issue where SNMP queries were not replied to due to an internal process timeout.

## PAN-214727

Fixed an issue where a memory leak related to the useridd process resulted in an OOM
condition, which caused the process to stop responding.

## PAN-214669

Fixed an issue where FIN and RESET packets were sent in reverse order.

## PAN-214463

Fixed an issue where IKE re-key negotiation failed with a third-party vendor and the firewall
acting as the initiator received a response with the VENDOR_ID
payload and the error message unexpected critical
payload (type 43).

## PAN-214201

Fixed an issue where, after exporting custom reports to CSV format, the letter b appeared at the beginning of each column.

## PAN-214186

Fixed an issue where category length was incorrect, which caused the
dataplane to restart.

## PAN-213956

Fixed an issue where the firewall interface did not go down even after the peer link/switch port went down.

## PAN-213931

Fixed an issue where the logrcvr process cache was not in sync with the mapping on the firewall.

## PAN-213296

Fixed an issue where Single Log-out (SLO) was not correctly triggered from the firewall toward
the client, which caused the client to not initiate the SLO request
toward the identity provider (IdP). This resulted in the IdP not
making the SLO callback to the firewall to remove the user.

## PAN-213162

Fixed an issue where an SD-WAN object was not displayed under a child device group.

## PAN-213112

Fixed an issue where executing the show report directory-listing CLI command resulted in no output after upgrading to a PAN-OS 10.1 release.

## PAN-212978

Fixed an issue where the firewall stopped responding when executing an SD-WAN debug CLI
command.

## PAN-212726

Fixed an issue where RTP/RTCP packets were dropped for SIP calls by SIP ALG when the source NAT translation type was persistent Dynamic IP And Port.

## PAN-212577

```caveat
PA-5200 Series and PA-7080 firewalls only
```

Fixed an issue where commits took longer than expected when more than 45,000 Security policy rules were configured.

## PAN-212240

Fixed an issue where packet capture was logged for an unknown application session when packet capture logging was disabled.

## PAN-212057

Fixed an issue where Advanced Threat Prevention caused SSL delays when no URL licenses were present.

## PAN-211441

Fixed a memory leak issue related to SSL crypto operations that resulted in failed commits.

## PAN-211398

Fixed an issue where dataplane processes stopped responding when handling HTTP/2 streams.

## PAN-211384

Fixed an issue where the size of the redisthost_1 in the Redis database continuously increased, which caused an OOM condition.

## PAN-210640

Fixed an issue where applications were not displayed after authenticating into the clientless VPN.

## PAN-210502

Fixed an issue where Panorama was unable to convert to PAN-OS 9.1 syntax for WF-500
appliances.

## PAN-210456

Fixed an issue where high latency occurred on PA-850-ZTP when SSL decryption was enabled.

## PAN-210452

Fixed an issue where application packet capture (pcap) was not generated when Security policy
rules were used as a filter.

## PAN-210429

```caveat
VM-Series firewalls only
```

Fixed an issue where the HTTP service failed to come up on DHCP dataplane interfaces after rebooting the firewall, which resulted in health-check failure on HTTP/80 with a 503 error code on the public load balancer.

## PAN-210364

Fixed an issue where high latency was observed when accessing internal web applications, which interrupted development activities related to the web server.

## PAN-209585

The Palo Alto Networks QoS implementation now supports a new QoS mode called lockless QoS for PA-3400, PA-5410, PA-5420, PA-5430, and PA-5440 firewalls. For firewalls with higher bandwidth QoS requirements, the lockless QoS dedicates cores to the QoS function that improves QoS performance, resulting in improved throughput and latency.

## PAN-209375

Fixed an issue on the firewall where log filtering did not work as expected.

## PAN-209288

Fixed an issue where generating certificates with SCEP did not work.

## PAN-209172

Fixed an issue where the firewall was unable to handle GRE packets for Point-to-Point Tunneling Protocol (PPTP) connections.

## PAN-209108

Fixed an issue where a Panorama in Management Only mode was unable to display logs from log
collectors due to missing schema files.

## PAN-208567

Fixed an issue with email formatting where, when a scheduled email contained two or more attachments, only one attachment was visible.

## PAN-208438

Fixed an issue on Panorama where Security policy rules incorrectly displayed as disabled.

## PAN-208395

Fixed an issue where user authentication failed in multi-vsys environments with the error message User is not in allowlist when an authentication profile was created in a shared configuration space.

## PAN-208316

Fixed an issue where user-group names were unable to be configured as the source user via the test security-policy-match command.

## PAN-208240

Fixed an issue where, when attempting to replace an existing certificate, importing a new certificate with the same name as the existing certificate failed due to mismatched public and private keys.

## PAN-208198

Fixed an issue with firewalls in active/passive HA configurations where, after rebooting the passive firewall, interfaces were briefly shown as powered up, and then shown as down or shutdown.

## PAN-208090

Fixed an issue where the ACC report did not display data when querying the filter for the fields Source and Destination IP.

## PAN-207604

Fixed an issue where system logs continuously generated the log message Not enough space to load content to SHM.

## PAN-207577

Fixed an issue where Panorama > Setup > Interfaces was not accessible for users with custom admin roles even when the interface option was selected for the custom admin roles.

## PAN-206765

Fixed an issue where log forwarding filters involving negation did not work.

## PAN-205015

Fixed an issue where not all users were included in the user group after an incremental sync between the firewall and the Cloud Identity Engine.

## PAN-204868

Fixed an issue where disk utilization was continuously high due to the log purger not sufficiently reducing the utilization level.

## PAN-204718

```caveat
PA-5200 Series firewalls only
```

Fixed an issue where, after upgrading to PAN-OS 10.1.6-h3, a TACACS user login displayed the following error message during the first login attempt: Could not chdir to home directory /opt/pancfg/home/user: Permission denied.

## PAN-203611

Fixed an issue where URL categorization was not recognized for URLs that contained more than 100 characters.

## PAN-202524

Fixed an issue where the session ID was missing in the session details section of the ingress-backlogs XML API output.

## PAN-199819

Fixed an issue where, if a decryption profile allowed TLSv1.3, but the server only supported
TLSv1.2, and the cipher used by the first connection to the server
was a CBC SHA2 cipher suite, the connection failed.

## PAN-198509

Fixed an issue where commits failed due to insufficient CFG memory.

## PAN-198453

Fixed an issue where you were unable to resize the Description pop-up window (Policies > Security > Prerules).

## PAN-198050

Fixed an issue where Connection to update server is successful messages displayed even when connections failed.

## PAN-197339

Fixed an issue where template configuration for the User-ID agent was not reflected on the template stack on Panorama appliances on PAN-OS 10.2.1.

## PAN-196345

Fixed an issue where scheduled dynamic content updates failed to be retrieved by managed firewalls from Panorama when connectivity was slow.

## PAN-189328

Fixed an issue where traffic belonging to the same session was sent out from different ECMP enabled interfaces.

## PAN-187989

Fixed an issue where a user who did not have permissions of other access domains were able to view the commit and configuration lock.

## PAN-185360

Fixed an issue where, when Authentication Portal Authentication was configured,
l3svc_ngx_error.log and
l3svc_access.log did not roll over
after exceeding 10 megabytes, which caused the root partition to
reach full utilization.

## PAN-180082

Fixed an issue where errors in brdagent logs caused dataplane path monitoring failure.

## PAN-177227

```caveat
VM-Series firewalls on Amazon Web Services environments only
```

Fixed an issue where traffic sent from a GENEVE tunnel to the firewall was dropped if the firewall attempted to encapsulate traffic into an IPSec tunnel.

## PAN-169586

Fixed an issue where scheduled log view reports in emails didn't match the monitor page query result for the same time interval.

## PAN-160633

```caveat
PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls only
```

Fixed an issue where
the dataplane restarted repeatedly due to an internal path
monitoring failure until a power cycle.
