From 462dcecb9583008bb7f66121f135e7186f5e70cf Mon Sep 17 00:00:00 2001 From: Aaron Axvig Date: Mon, 13 Apr 2026 09:40:26 -0500 Subject: [PATCH] Add two new PAN-OS 11.2 releases --- .../PAN-OS/addressed/11.2.10-h5_2026-04-13.md | 165 ++++++++++++++++++ .../PAN-OS/addressed/11.2.7-h12_2026-04-13.md | 153 ++++++++++++++++ web/data/products.json | 7 +- 3 files changed, 323 insertions(+), 2 deletions(-) create mode 100644 web/data/issues/PAN-OS/addressed/11.2.10-h5_2026-04-13.md create mode 100644 web/data/issues/PAN-OS/addressed/11.2.7-h12_2026-04-13.md diff --git a/web/data/issues/PAN-OS/addressed/11.2.10-h5_2026-04-13.md b/web/data/issues/PAN-OS/addressed/11.2.10-h5_2026-04-13.md new file mode 100644 index 0000000..575d39d --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.2.10-h5_2026-04-13.md @@ -0,0 +1,165 @@ +--- +type: Addressed +product: PAN-OS +version: 11.2.10-h5 +--- + +## PAN-318275 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where the firewall became unresponsive and did not automatically reboot, which led to prolonged outages. With this fix, the Linux kernel configuration will trigger a system panic and reboot. + +## PAN-316911 + +```caveat +VM-Series firewalls on Amazon Web Services (AWS) environments only +``` + +Fixed an issue where a newly bootstrapped firewall required a management server restart, relicensing, or license push from Panorama to invoke the device certificate. + +## PAN-315912 + +Fixed an issue where the Maximum Segment Size (MSS) rewrite functionality for packets ingressing through SD-WAN interfaces on firewalls was not optimized. + +## PAN-314147 + +Fixed an issue where SSL traffic was dropped on SD-WAN DIA interfaces with member having different MTU. + +## PAN-313623 + +Fixed an issue where the /opt/pancfg/mgmt/ssl/private/ directory on Palo Alto Networks devices with TPM support became 100% utilized due to an accumulation of undeleted .pub_pem files. This occurred because executing the show device-certificate status CLI command initiated a process that generated these files but failed to remove them, which prevented the fetching of new device certificates. + +## PAN-313216 + +Fixed an issue where firewalls with Prisma Access incorrectly displayed some traffic as unsanctioned in traffic logs for cloud applications that were tagged as **sanctioned**. + +## PAN-312706 + +Fixed an issue where the firewalls restarted due to a function lacking a NULL-pointer sanity check. + +## PAN-311512 + +Fixed an issue where HIP (Host Information Profile) reports were blocked on GlobalProtect when **Authentication Cookie Usage Restrictions** was enabled and the Prisma Access Agent protocol was in use. This occurred because the system failed to correctly process HIP messages that were relayed via IPSec tunnels with a Virtual IP as the source, leading to their rejection. + +## PAN-309300 + +Fixed an issue where management plane system resources configuration size exceeded 28 MB for over 4 hours, and the following error message was displayed: Configuration size reaching device capacity limit. + +## PAN-308786 + +```caveat +Panorama appliances only +``` + +Fixed an issue where traffic log queries using the **device_name** filter returned no results, and complex log queries that included negation operators produced incorrect outputs. + +## PAN-308564 + +Fixed an issue where packets were dropped on SD-WAN interfaces when a proxy was enabled due to an MTU inconsistency where the firewall failed to rewrite the maximum segment size in SYN/ACK packets based on the SD-WAN virtual interface MTU. + +**Note**: This fix does not apply when the traffic egress interface is SD-WAN Direct Internet Access (DIA) interface and proxy is enabled. + +## PAN-308507 + +```caveat +Panorama managed firewalls only +``` + +Fixed an issue where the firewall intermittently failed to maintain active log forwarding streams to Strata Logging Service (SLS) even when duplicate logging and enhanced application logging were enabled. + +## PAN-308418 + +Fixed an issue where, when Advanced DNS Security was enabled and experienced unusually high loads, DNS resolution failures occurred with the error **resources-unavailable**. + +## PAN-306555 + +Fixed an issue where the firewall stopped responding, which led to service outages. + +## PAN-304019 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where the firewall did not send traffic to SCM or SLS via a configured explicit proxy IP address when the proxy username was not configured. + +## PAN-303745 + +Fixed an issue where inter-dataplane forwarding did not work for sessions ingressing on Slot 2, which resulted in intermittent ping failures to interfaces on Network Card 2 when traffic was forwarded to Slot 3. + +**Note**: With this fix, after a slot restart, the global counter will still show dot1q errors for a short period. + +## PAN-302564 + +Fixed an issue on the firewall where a path monitoring failure occurred and caused the dataplane to restart. + +## PAN-301653 + +Fixed an issue where DNS traffic sessions prematurely terminated with the message resources-unavailable. This occurred due to IPv4 fragmented DNS responses causing the Advanced DNS Security module to incorrectly pack the DNS payload multiple times when forwarding to the cloud for inspection. + +## PAN-302983 + +Fixed an issue where, after committing changes on Panorama, a shared post-rule moved to the end of the post shared rulebase on the managed device instead of remaining at the top. + +## PAN-300837 + +Fixed an issue where firewalls experienced multiple reboots due to the pan_task process restarting with a SIGSEGV signal. This occurred because the client-to-firewall side assumed TLS 1.3 for the firewall-server side. + +## PAN-300671 + +Fixed an issue where traffic reports that were generated with destination/source and destination/source hostnames were not displayed in IPv4 format. + +## PAN-300423 + +Fixed an issue where Data Processing Cards (DPCs) installed in slots 5 and 6 remained stuck in a starting state with the error **Signal detected for port xeS5-DP0 but Link Down** alerts, which resulted in device instability. + +## PAN-299242 + +Fixed an issue where the firewall's SSL proxy sent an empty HTTP2 SETTINGS message to the client before confirming server support, which caused some clients to incorrectly assume HTTP/2 support and not fall back to HTTP/1.1. Additionally, the firewall dropped HTTP1.1 400 Bad Request frames from the server, which prevented the client from correctly detecting the lack of HTTP/2 support. + +## PAN-298617 + +Optimized the commit workflow to reduce the size of the effective configuration, resulting in lower memory consumption. + +## PAN-297708 + +Fixed an issue where a long-lived session with many Machine Learning (ML) model triggers caused a memory leak of feature states associated with the ML model runs. This resulted in Spyware_State failure increases, allocation max outs, and impaired policy matching. + +## PAN-295802 + +Fixed an issue where a memory leak related to the configd process occurred. + +## PAN-295309 + +Fixed an issue where OSPF session using MD5 authentication experienced intermittent flapping due to out-of-order packet processing. + +## PAN-293644 + +```caveat +Firewalls in HA configurations only +``` + +Fixed an issue where the configd process stopped responding during an External Dynamic List (EDL) refresh. + +## PAN-290938 + +Fixed an issue where multiple memory leaks occurred related to the configd process. + +## PAN-264762 + +Fixed an issue where the firewall showed the status of SFP+ interfaces as not up, or up but not configured, when a PAN-SFP-PLUS-SR cable was connected. + +## PAN-263691 + +Fixed an issue where the firewall rebooted unexpectedly due to a memory leak in the all_task process. + +## PAN-250339 + +Added an improvement to automatically clean up idle HTTP connection pools to address an issue where idle connection pools accumulated when a circuit breaker limit was reached, which caused client requests to fail with a 503 no_healthy_upstream error. + +## PAN-248913 + +Fixed an issue where the Elasticsearch client certificate was not auto renewed, which caused it to enter a Red state, and logs were not displayed in Panorama. diff --git a/web/data/issues/PAN-OS/addressed/11.2.7-h12_2026-04-13.md b/web/data/issues/PAN-OS/addressed/11.2.7-h12_2026-04-13.md new file mode 100644 index 0000000..eb6914f --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/11.2.7-h12_2026-04-13.md @@ -0,0 +1,153 @@ +--- +type: Addressed +product: PAN-OS +version: 11.2.7-h12 +--- + +## PAN-316911 + +```caveat +VM-Series firewalls on Amazon Web Services (AWS) environments only +``` + +Fixed an issue where a newly bootstrapped firewall required a management server restart, relicensing, or license push from Panorama to invoke the device certificate. + +## PAN-315912 + +Fixed an issue where the Maximum Segment Size (MSS) rewrite functionality for packets ingressing through SD-WAN interfaces on firewalls was not optimized. + +## PAN-314147 + +Fixed an issue where SSL traffic was dropped on SD-WAN DIA interfaces with member having different MTU. + +## PAN-313623 + +Fixed an issue where the /opt/pancfg/mgmt/ssl/private/ directory on Palo Alto Networks devices with TPM support became 100% utilized due to an accumulation of undeleted .pub_pem files. This occurred because executing the show device-certificate status CLI command initiated a process that generated these files but failed to remove them, which prevented the fetching of new device certificates. + +## PAN-313216 + +Fixed an issue where firewalls with Prisma Access incorrectly displayed some traffic as unsanctioned in traffic logs for cloud applications that were tagged as **sanctioned**. + +## PAN-312706 + +Fixed an issue where the firewalls restarted due to a function lacking a NULL-pointer sanity check. + +## PAN-311512 + +Fixed an issue where HIP (Host Information Profile) reports were blocked on GlobalProtect when **Authentication Cookie Usage Restrictions** was enabled and the Prisma Access Agent protocol was in use. This occurred because the system failed to correctly process HIP messages that were relayed via IPSec tunnels with a Virtual IP as the source, leading to their rejection. + +## PAN-309300 + +Fixed an issue where management plane system resources configuration size exceeded 28 MB for over 4 hours, and the following error message was displayed: Configuration size reaching device capacity limit. + +## PAN-308786 + +```caveat +Panorama appliances only +``` + +Fixed an issue where traffic log queries using the **device_name** filter returned no results, and complex log queries that included negation operators produced incorrect outputs. + +## PAN-308564 + +Fixed an issue where packets were dropped on SD-WAN interfaces when a proxy was enabled due to an MTU inconsistency where the firewall failed to rewrite the maximum segment size in SYN/ACK packets based on the SD-WAN virtual interface MTU. + +**Note**: This fix does not apply when the traffic egress interface is SD-WAN Direct Internet Access (DIA) interface and proxy is enabled. + +## PAN-308507 + +```caveat +Panorama managed firewalls only +``` + +Fixed an issue where the firewall intermittently failed to maintain active log forwarding streams to Strata Logging Service (SLS) even when duplicate logging and enhanced application logging were enabled. + +## PAN-308418 + +Fixed an issue where, when Advanced DNS Security was enabled and experienced unusually high loads, DNS resolution failures occurred with the error **resources-unavailable**. + +## PAN-306555 + +Fixed an issue where the firewall stopped responding, which led to service outages. + +## PAN-304019 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where the firewall did not send traffic to SCM or SLS via a configured explicit proxy IP address when the proxy username was not configured. + +## PAN-303745 + +Fixed an issue where inter-dataplane forwarding did not work for sessions ingressing on Slot 2, which resulted in intermittent ping failures to interfaces on Network Card 2 when traffic was forwarded to Slot 3. + +**Note**: With this fix, after a slot restart, the global counter will still show dot1q errors for a short period. + +## PAN-302983 + +Fixed an issue where, after committing changes on Panorama, a shared post-rule moved to the end of the post shared rulebase on the managed device instead of remaining at the top. + +## PAN-302564 + +Fixed an issue on the firewall where a path monitoring failure occurred and caused the dataplane to restart. + +## PAN-301653 + +Fixed an issue where DNS traffic sessions prematurely terminated with the message resources-unavailable. This occurred due to IPv4 fragmented DNS responses causing the Advanced DNS Security module to incorrectly pack the DNS payload multiple times when forwarding to the cloud for inspection. + +## PAN-300837 + +Fixed an issue where firewalls experienced multiple reboots due to the pan_task process restarting with a SIGSEGV signal. This occurred because the client-to-firewall side assumed TLS 1.3 for the firewall-server side. + +## PAN-300671 + +Fixed an issue where traffic reports that were generated with destination/source and destination/source hostnames were not displayed in IPv4 format. + +## PAN-300423 + +Fixed an issue where Data Processing Cards (DPCs) installed in slots 5 and 6 remained stuck in a starting state with the error **Signal detected for port xeS5-DP0 but Link Down** alerts, which resulted in device instability. + +## PAN-299242 + +Fixed an issue where the firewall's SSL proxy sent an empty HTTP2 SETTINGS message to the client before confirming server support, which caused some clients to incorrectly assume HTTP/2 support and not fall back to HTTP/1.1. Additionally, the firewall dropped HTTP1.1 400 Bad Request frames from the server, which prevented the client from correctly detecting the lack of HTTP/2 support. + +## PAN-298617 + +Optimized the commit workflow to reduce the size of the effective configuration, resulting in lower memory consumption. + +## PAN-297708 + +Fixed an issue where a long-lived session with many Machine Learning (ML) model triggers caused a memory leak of feature states associated with the ML model runs. This resulted in Spyware_State failure increases, allocation max outs, and impaired policy matching. + +## PAN-295802 + +Fixed an issue where a memory leak related to the configd process occurred. + +## PAN-295309 + +Fixed an issue where OSPF session using MD5 authentication experienced intermittent flapping due to out-of-order packet processing. + +## PAN-293644 + +```caveat +Firewalls in HA configurations only +``` + +Fixed an issue where the configd process stopped responding during an External Dynamic List (EDL) refresh. + +## PAN-290938 + +Fixed an issue where multiple memory leaks occurred related to the configd process. + +## PAN-264762 + +Fixed an issue where the firewall showed the status of SFP+ interfaces as not up, or up but not configured, when a PAN-SFP-PLUS-SR cable was connected. + +## PAN-263691 + +Fixed an issue where the firewall rebooted unexpectedly due to a memory leak in the all_task process. + +## PAN-248913 + +Fixed an issue where the Elasticsearch client certificate was not auto renewed, which caused it to enter a Red state, and logs were not displayed in Panorama. diff --git a/web/data/products.json b/web/data/products.json index 7ef6079..1dd9ae8 100644 --- a/web/data/products.json +++ b/web/data/products.json @@ -18,7 +18,8 @@ "12.1.3_2026-03-31.md", "12.1.4_2026-03-31.md", "12.1.5_2026-03-31.md", - "12.1.6_2026-03-31.md"] + "12.1.6_2026-03-31.md" + ] } }, "11": { @@ -78,9 +79,11 @@ "11.2.5_2026-03-16.md", "11.2.6_2026-03-16.md", "11.2.7_2026-03-16.md", + "11.2.7-h12_2026-04-13.md", "11.2.8_2026-03-16.md", "11.2.9_2026-03-16.md", - "11.2.10_2026-03-16.md" + "11.2.10_2026-03-16.md", + "11.2.10-h5_2026-04-13.md" ] }, "11.1": {