Issue ID | Description
--- | ---
PAN-310868 | Fixed an issue where PA Explicit proxy blocked ICMP packets from flowing towards Envoy for Geneve due to the router not camping MSS when the MTU was lower in the path.
PAN-307901 | Fixed an issue where a leak in decryption counters caused resource exhaustion, which led to a GlobalProtect service outage.
PAN-306502 | Fixed two issues that impacted TLSv1.2 or earlier sessions when the traffic matched a decryption policy rule with the no-decrypt action: Connections failed when both HTTP header insertion (Objects > Security Profiles > URL Filtering > HTTP Header Insertion) and Send handshake messages to CTD for inspection (Device > Setup > Session > Decryption Settings > SSL Decryption Settings) were enabled. New sessions failed due to software packet buffer resource depletion, which occurred when Log Successful SSL Handshake was disabled in the decryption policy rule and the decryption profile attached to the rule had both Block sessions with expired certificates and Block sessions with untrusted issuers disabled.
PAN-306103 | (`PA-3400 and PA-5400 Series firewalls only`) Fixed an issue where the firewall dataplane frequently restarted when lockless QoS was enabled
PAN-303959 | Fixed an issue where traffic was incorrectly identified as unknown-tcp/unknown-udp due to App-ID resource leak and eventually dropped.
PAN-302767 | Fixed an issue where IPv6 IPsec WAN support was not available in Prisma Access.
PAN-301222 | Fixed an issue where DNS Security logs incorrectly displayed a sinkhole action for benign DNS categories due to the firewall saving the drop or sinkhole action in session flags without discarding the session.
PAN-300638 | (`VM-Series firewalls only`) Fixed an issue where the firewall stopped responding due to an out-of-bounds read when parsing TLS 1.3 clientHello messages with large TLS clientHello extensions where the supported_versions extension fell outside the first TCP segment.
PAN-297295 | (`VM-Series firewalls in Microsoft Azure environments only`) Fixed an issue where the firewall repeatedly restarted due to high packet rates on the synthetic path in DPDK mode.
PAN-295803 | Addressed a memory leak issue under sc3 and automatic commit recovery (ACR) code path.
PAN-294488 | Fixed an issue where certificate data was missing in decryption logs for No decrypt policy rules and TLS1.2 traffic after upgrading, and the `Subject Common Name`, Issuer Common Name, Certificate Start Date, Certificate End Date, Certificate Serial Number, and Certificate Fingerprint fields were blank in the decryption logs.
PAN-283563 | Fixed an issue where the GlobalProtect gateway firewall intermittently failed to assign an IP address to GlobalProtect clients from the DHCP server, even after successfully receiving a DHCP offer. This occurred when the DHCP retry and timeout settings were overwritten due to parsing results being stored in the same variable, which caused the last gateway configuration to take effect.
PAN-271438 | Fixed an issue where the firewall calculated available memory incorrectly on CENTOS devices, which caused the firewall to display high memory usage alerts even when sufficient memory was available.
PAN-267328 | Fixed an issue where the all_task process stopped responding, which caused the firewall to stop processing traffic.
PAN-259853 | Fixed an issue where, when the DHCP server was enabled for GlobalProtect, the commit error message was not properly displayed when Any was selected as the source interface in the service router configuration (Device Setup Service Service Router Configuration).
PAN-258039 | Fixed an issue where the firewall displayed the incorrect rule name when a threat log was generated for Inline Cloud Analyzed CMD Injection Traffic Detection.