---
type: Addressed
product: PAN-OS
version: 8.1.19
source: common-crawl
crawl: CC-MAIN-2026-12
---

## PAN-161731

Functionality was added to enable, via the CLI, the removal of key exchange algorithms used by SSH.

- Use debug system ssh-kex-prune cipher [diffie-hellman-group1-sha1 diffie-hellman-group-exchange-sha1 .. ] to enable removal of specified key exchanges.
- Use debug system ssh-kex-prune none to enable addition of key exchanges.

## PAN-159135

Fixed an issue where the firewall rejected SAML Assertions, which caused user authentication failure when the **Validate Identity Provider Certificate** was enabled in the SAML Server Profile in vsys3 or above.

## PAN-158988

Fixed an issue with HTTP Header Insertion where the payload was truncated when processing a segmented TCP stream and when the client retransmitted the packet with the same sequence number that was previously received segmented.

## PAN-158844

Adds additional debugging to be used in identifying the malformed references causing process crashes during FQDN refresh.

## PAN-158638

Fixed an issue where the firewall returned the following error message when attempting to request a device certificate using a one-time password (OTP): invalid ocsp response sig-alg.

## PAN-156240

A fix was made to address an issue where a cryptographically weak pseudo-random number (PRNG) was used during authentication to the PAN-OS interface. As a result, attackers with the capability to observe their own authentication secrets over a long duration on the firewall had the ability to impersonate another authenticated web interface administrator’s session ([CVE-2021-3047](https://security.paloaltonetworks.com/CVE-2021-3047)).

## PAN-155009

Fixed an issue on the firewall where executing the request system bootstrap-usb prepare CLI command returned a server error.

## PAN-154114

A fix was made to address a vulnerability related to information exposure through log files in PAN-OS where secrets in PAN-OS XML API requests were logged in cleartext in the web server logs when the API was used incorrectly ([CVE-2021-3036](https://security.paloaltonetworks.com/CVE-2021-3036)).

## PAN-153213

Fixed a rare issue where TCP packets randomly dropped due to reassembly failure.

## PAN-152648

Fixed an issue where multiple all_pktproc processes stopped responding, which caused the dataplane to restart.

## PAN-152098

Fixed an issue where the Policy Optimizer for some device groups showed incorrect data with a - character in the rule usage column.

## PAN-151458

Fixed an issue on firewalls with high availability active/active configurations where GlobalProtect gateways timed out on-demand connections. This occurred because the **Inactivity Logout** timer did not reset.

## PAN-150998

Fixed an issue where, when deploying a VM-Series firewall on VMware NSX that had been assigned a serial number that was used by a previously deactivated firewall, the new firewall was deployed in a deactivated or partially deactivated state.

## PAN-150852

Fixed an issue with SMTP that occurred when attachment file names were longer than the allocated buffer. If the file name was longer than the buffer and Layer 7 inspection was enabled, the file was dropped, which caused session errors and an email to not be sent.

## PAN-150798

```caveat
PA-7000 Series firewalls only
```

Fixed an issue where Network Processing Cards (NPC) took longer than expected or failed to boot.

## PAN-150023

A fix was made to address an issue where an improper authentication vulnerability enabled a Security Assertion Markup Language (SAML) authenticated user to impersonate any user in the GlobalProtect portal and GlobalProtect gateway when they were configured to use SAML authentication ([CVE-2021-3046](https://security.paloaltonetworks.com/CVE-2021-3046)).

## PAN-149641

Fixed an issue where firewalls stopped refreshing IP tag information when configured with the **VM Information Sources** feature with a VMWare vCenter Server.

## PAN-149339

Fixed an issue where, when an ECMP route changed, the flow table in the offload engine was not updated.

## PAN-147783

Checks were added to help prevent the dataplane from restarting.

## PAN-147781

A fix was made to address an issue where an OS command argument injection vulnerability in the PAN-OS web interface enabled an authenticated administrator to read any arbitrary file from the file system ([CVE-2021-3045](https://security.paloaltonetworks.com/CVE-2021-3045)).

## PAN-147254

jQuery was updated to 3.5.1.

## PAN-147221

Improved QoS scheduling for Bidirectional Forwarding Detection (BFD) and BGP to address the internal handling of BGP and BFD packets under high resource constraints

## PAN-145733

Fixed an issue where the SNMP INDEX for panZoneTable on the PAN-COMMON-MIB.my file did not work as expected, which led to entries in panZoneTable not being uniquely identified.

## PAN-144975

Fixed an intermittent issue where a high traffic load in a Layer 2 deployment caused SNMP and Panorama health monitoring failures.

## PAN-136347

Fixed an issue wherer DNS proxy TCP connections were processed incorrectly, which caused a process (dnsproxy) to stop responding.

## PAN-136073

Fixed an issue where the High Speed Chassis Interconnect (HSCI) port flapped continuously after an upgrade or reboot.

## PAN-132035

Fixed an issue on Panorama appliances in an active/passive HA configuration where a managed firewall generated high priority alerts that it failed to connect to the passive Panorama appliance's User-ID agent server. This issue occurred because the firewall was only able to connect to one Panorama User-ID server at a time, and it connected only to the active Panorama appliance's User-ID server.

## PAN-131474

A fix was made to address a vulnerability related to information exposure through log files in PAN-OS where the connection details for a scheduled configuration export were logged in system logs ([CVE-2021-3037](https://security.paloaltonetworks.com/CVE-2021-3037)).

## PAN-128042

Fixed an issue where the dynamic address group failed due to a process (devsrvr) not being synced with another process (useridd).

## PAN-124579

Fixed an issue where a process (all_task_3) restarted, which caused the tunnels to reset.
