--- type: Addressed product: PAN-OS version: 10.0.5 source: common-crawl crawl: CC-MAIN-2026-12 --- ## PAN-164922 Fixed an issue on Panorama where a context switch to a managed firewall running PAN-OS 8.1.0 to PAN-OS 8.1.19 failed. To utilize this fix, upgrade Panorama to PAN-OS 10.0.5. ## PAN-164674 Fixed a memory leak issue related to a process (mprelay) that was caused by ARP and route entries not being freed after skipping duplicate updates. ## PAN-163538 Fixed an issue on multi-dataplane platforms where traffic through Large Scale VPN (LSVPN) tunnels dropped with the error message tunnel resolution failure. ## PAN-163503 Fixed an issue on the passive firewall in a high availability (HA) configuration where a SD-WAN virtual network interface (VIF) status check caused associated static routes to be incorrectly withdrawn from the FIB. ## PAN-163489 Fixed an issue where an SD-WAN VIF was incorrectly detected as inactive during the commit time, which caused associated route withdrawal. ## PAN-163415 Fixed an issue where a memory leak related to the configd process occurred if the SD-WAN plugin was installed and many templates were configured on Panorama. ## PAN-163274 Fixed an issue where the SD-WAN hub firewall sent traffic via a VPN tunnel interface that was inactive. ## PAN-162746 Fixed an issue where DNS over TCP caused a process (dnsproxy) to run out of memory. ## PAN-162743 Fixed an issue where the firewall did not receive updates for the Device Dictionary, which caused the firewall to replace new attributes in the IP address-to-device mappings with unknown. ## PAN-162534 ```caveat VM-Series firewalls on Amazon Web Services (AWS) using a Gateway Load Balancer (GWLB) only ``` Fixed an issue where when the VM-Series firewall on AWS is integrated with a GWLB, GlobalProtect did not work. ## PAN-162256 Fixed an issue where incorrect WildFire verdicts displayed on Panorama from Cortex Data Lake. ## PAN-162059 Fixed an issue where, after a new Layer 3 interface was created in PAN-OS 10.0.3 or 10.0.4, a downgrade to a PAN-OS 9.0 version failed with the error message U pstream NAT not supported in older version. This issue occurred whether SD-WAN was configured on the firewall or not. ## PAN-161767 Fixed an issue where, due to a dataplane sync issue, SD-WAN traffic was forwarded to a tunnel that was inactive. ## PAN-161745 Fixed an issue where the time-to-live (TTL) value received from the DNS server reset to 0 on DNS secure TCP transactions when anti-spyware profiles were used, which caused DNS dynamic updates to fail. ## PAN-161562 Enhanced security in how Palo Alto Networks next-generation VM-Series and PA-Series firewalls handle asymmetric traffic. ## PAN-161428 Fixed an issue where multiple restarts on a process (all_pktproc) occurred on firewalls in an active/passive HA configuration. ## PAN-160782 Fixed an issue where the routed process stopped responding when the BGP peer sent AS_PATHs with more than 255 AS numbers in all of the segments combined. There can now be a maximum of 255 AS numbers in an AS_PATH list for a prefix. ## PAN-160556 Fixed an issue that prevented decryption and IP-tag logs from being forwarded to the syslog over TCP. ## PAN-160499 Fixed an issue on Panorama where, after an upgrade to a PAN-OS 10.0 release version, configuration pushes failed with the error Need to config WMI account and password for querying Microsoft directory servers. ## PAN-160455 A fix was made to address an issue where certain invalid URL entries contained in an External Dynamic List (EDL) caused the devsrvr process to stop responding ([CVE-2021-3048](https://security.paloaltonetworks.com/CVE-2021-3048)). ## PAN-159692 Fixed an issue where the **/dev/shm** partition increased to 100% disk usage with multiple older versions of WildFire content updates. ## PAN-159393 Fixed an issue where some TSL1.3 websites were not accessible when decryption was enabled. ## PAN-159135 Fixed an issue where the firewall rejected SAML Assertions, which caused user authentication failure when the **Validate Identity Provider Certificate** was enabled in the SAML Server Profile in vsys3 or above. ## PAN-158844 Adds additional debugging to be used in identifying the malformed references causing process crashes during FQDN refresh. ## PAN-158774 Fixed an issue where random DNS queries dropped with the counter ctd_dns_wait_pkt_drop when DNS security was enabled. ## PAN-158723 A fix was made to address an improper handling of exception conditions in the PAN-OS dataplane that enabled an unauthenticated network-based attacker to send specifically crafted traffic through the firewall that caused the service to crash ([CVE-2021-3053](https://security.paloaltonetworks.com/CVE-2021-3053)). ## PAN-158638 Fixed an issue where the firewall returned the following error message when attempting to request a device certificate using a one-time password (OTP): invalid ocsp response sig-alg. ## PAN-158585 Fixed a memory leak issue related to the X-Forwarded-For (XFF) security feature. ## PAN-158328 Fixed an issue where the firewall stopped populating the multicast FIB table with OIL entries for multicast groups. ## PAN-158293 Fixed an issue where a sudden increase in packet buffer descriptors disrupted traffic. ## PAN-158122 Fixed an issue where SNMP readings reported 0 for dataplane interface packet statistics when using PacketMMAP mode. This issue occurred because the physical port counters read from MAC addresses were reported as 0. ## PAN-157735 Fixed an issue where the new PA-7000100G network processing card (NPC) took 25 minutes to start after rebooting the PA-7080 chassis. ## PAN-157721 Fixed an issue where the firewall dropped GPRS tunneling protocol (GTPv2) Create Session Requests and Responses that had IEs 201 and 202 with the error Abnormal GTPv2-C message with invalid IE. ## PAN-157346 Fixed an issue where HIP custom checks for plist failed when the HIP exclusion category were configured under (**Mobile User Template > Network > GlobalProtect > Portal > Agent > HIP Data Collection**). ## PAN-157271 Fixed an issue where **Panorama > Cloud Services** was visible to users with device group and template admin roles even if the admin role was disabled. ## PAN-157266 Fixed an issue with the logrcvr process that caused inaccurate netflow values. ## PAN-157168 Fixed an issue where a process (mprelay) stopped responding when displaying debug PDT commands ## PAN-157049 ```caveat PA-3200 Series firewalls only ``` Fixed an issue where the firewall processed internal path monitoring packets more slowly than expected when processing large amounts of traffic, which caused the dataplane to restart. ## PAN-156982 Fixed an issue where the firewall didn't resolve domain names with multiple nested Canonical Name (CNAME) records when caching was enabled. ## PAN-156891 Fixed an issue where some zip files did not download and the following error message displayed: resources-unavailable. ## PAN-156716 Fixed an issue where the firewall sent ARP replies without checking the ingress interface when the requested IP address was configured as a destination NAT (DNAT) address. ## PAN-156498 Fixed an issue where the User-ID Agent did not reconnect after being disconnected. ## PAN-156264 Fixed an issue where the firewall displayed **IP address** **Netmask** and **default gateway** as **unknown** on the web interface as well as the CLI. ## PAN-156225 ```caveat PA-3200 Series firewalls only ``` Fixed an issue where the HA1-B port remained down after an upgrade from PAN-OS 9.1.4 to PAN-OS 9.1.5. ## PAN-155656 Fixed an issue where multicast RTP traffic triggered unicast RTP Control Protocol (RTCP), and the predict session failed to install, which blocked the parent RTP session from forwarding packets. ## PAN-155294 Fixed an issue where iPad devices did not display Authentication Portal multi-factor authentication (MFA) pages correctly when using Okta for push notifications. ## PAN-154899 Fixed an out-of-memory (OOM) issue on the firewalls that caused LACP, BGP, and OSPF to go down, resulting in the firewall not receiving LACPDU messages. ## PAN-154844 Fixed an issue where commits and autocommits repeatedly failed due to an OOM condition that disrupted the processes pan_task and devsrvr. ## PAN-154812 Fixed a memory leak issue related to a process (configd) that was caused by log queries filtering by address. ## PAN-154376 Fixed an issue where a process (mgmtsrvr) stopped responding and was inaccessible through SSH or HTTPS until the firewall was power cycled. ## PAN-154195 Fixed an issue where the firewall dropped VoIP traffic over IPSec with counters flow_predict_convert_rtp_drop and flow_predict_convert_failed. ## PAN-154145 ```caveat VM-Series firewalls only ``` Fixed an issue where the management plane CPU was incorrectly reported to be high. ## PAN-153614 Fixed an issue where user-based policies did not correctly match if the same user was included in both a policy with the username in NetBIOS format and another policy with the username in FQDN format. ## PAN-153213 Fixed a rare issue where TCP packets randomly dropped due to reassembly failure. ## PAN-152998 Fixed an issue where the User-ID process CPU usage remained high when a large number of Terminal Server (TS) agents were configured but only a few were connected. ## PAN-152813 Fixed an issue with configuration memory leaks on Panorama that caused a process (configd) to restart. ## PAN-152458 ```caveat VM-Series firewalls on Microsoft Hyper-V only ``` Fixed an issue where, when upgrading to PAN-OS 9.0.8 or later, ethernet packets dropped after adding VLAN tags during egress from a subinterface. To leverage this fix, set the interface level maximum transmission unit (MTU) to 1496 or less. ## PAN-151808 Fixed an issue where an EDL refresh job did not complete when the configuration for EDL servers used certificate profiles, due to the large server certificates. ## PAN-151218 ```caveat PA-3200 Series firewalls only ``` Fixed an issue where the `crashinfo` file was not generated after a process (all_pktproc) stopped responding on the dataplane before path monitoring triggered a device reboot. ## PAN-150867 An enhancement was made to enable additional logging during kernel panic/oops that helps identify the cause. ## PAN-150798 ```caveat PA-7000 Series firewalls only ``` Fixed an issue where Network Processing Cards (NPC) took longer than expected or failed to boot. ## PAN-150023 A fix was made to address an issue where an improper authentication vulnerability enabled a Security Assertion Markup Language (SAML) authenticated user to impersonate any user in the GlobalProtect portal and GlobalProtect gateway when they were configured to use SAML authentication ([CVE-2021-3046](https://security.paloaltonetworks.com/CVE-2021-3046)). ## PAN-148549 Fixed an issue where newly created interface management profiles were unable to be linked to subinterfaces. ## PAN-147783 Checks were added to help prevent the dataplane from restarting. ## PAN-147228 Fixed an issue where an application's domain name didn't resolve if the cache was disabled on the DNS Proxy object being used in the GlobalProtect Clientless VPN. ## PAN-144538 Fixed an issue where locally disabling the rule hit-count feature on Panorama caused a memory leak. ## PAN-144470 Fixed an issue where driver descriptor rings were out of sync in the control plane to dataplane direction, which caused internal path monitoring heartbeat failures. ## PAN-142473 Fixed an issue where a commit failed with the following error message: Disk quotas add up to more than 100%. Invalid configuration. due to an integration issue. ## PAN-136478 ```caveat PA-7000 Series firewalls ``` where syslog forwarding over TCP did not work in a multi-vsys environment. ## PAN-136347 Fixed an issue wherer DNS proxy TCP connections were processed incorrectly, which caused a process (dnsproxy) to stop responding. ## PAN-134799 Fixed an issue where packets of the same session were forwarded through a different member of an Aggregate Ethernet (AE) group once the session was offloaded. ## PAN-129927 ```caveat VM-Series firewalls only ``` Fixed an issue where firewalls with Layer 3 subinterfaces reset Class of Service (CoS) bits in 802.1q.