---
type: Addressed
product: PAN-OS
version: 11.2.7-h10
---

## PAN-310868

Fixed an issue where PA Explicit proxy blocked ICMP packets from flowing towards Envoy for Geneve due to the router not camping MSS when the MTU was lower in the path.

## PAN-307901

Fixed an issue where a leak in decryption counters caused resource exhaustion, which led to a GlobalProtect service outage.

## PAN-306502

Fixed two issues that impacted TLSv1.2 or earlier sessions when the traffic matched a decryption policy rule with the no-decrypt action:

- Connections failed when both HTTP header insertion (**Objects > Security Profiles > URL Filtering > HTTP Header Insertion**) and **Send handshake messages to CTD for inspection** (**Device > Setup > Session > Decryption Settings > SSL Decryption Settings**) were enabled.
- New sessions failed due to software packet buffer resource depletion, which occurred when Log Successful SSL Handshake was disabled in the decryption policy rule and the decryption profile attached to the rule had both **Block sessions with expired certificates** and **Block sessions with untrusted issuers** disabled.

## PAN-306103

```caveat
PA-3400 and PA-5400 Series firewalls only
```

Fixed an issue where the firewall dataplane frequently restarted when lockless QoS was enabled

## PAN-303959

Fixed an issue where traffic was incorrectly identified as unknown-tcp/unknown-udp due to App-ID resource leak and eventually dropped.

## PAN-302767

Fixed an issue where IPv6 IPsec WAN support was not available in Prisma Access.

## PAN-301222

Fixed an issue where DNS Security logs incorrectly displayed a sinkhole action for benign DNS categories due to the firewall saving the drop or sinkhole action in session flags without discarding the session.

## PAN-300638

```caveat
VM-Series firewalls only
```

Fixed an issue where the firewall stopped responding due to an out-of-bounds read when parsing TLS 1.3 clientHello messages with large TLS clientHello extensions where the supported_versions extension fell outside the first TCP segment.

## PAN-297295

```caveat
VM-Series firewalls in Microsoft Azure environments only
```

Fixed an issue where the firewall repeatedly restarted due to high packet rates on the synthetic path in DPDK mode.

## PAN-295803

Addressed a memory leak issue under sc3 and automatic commit recovery (ACR) code path.

## PAN-294488

```caveat
Subject Common Name
```

Fixed an issue where certificate data was missing in decryption logs for **No decrypt** policy rules and TLS1.2 traffic after upgrading, and the , **Issuer Common Name**, **Certificate Start Date**,**Certificate End Date**, **Certificate Serial Number**, and **Certificate Fingerprint** fields were blank in the decryption logs.

## PAN-283563

Fixed an issue where the GlobalProtect gateway firewall intermittently failed to assign an IP address to GlobalProtect clients from the DHCP server, even after successfully receiving a DHCP offer. This occurred when the DHCP retry and timeout settings were overwritten due to parsing results being stored in the same variable, which caused the last gateway configuration to take effect.

## PAN-271438

Fixed an issue where the firewall calculated available memory incorrectly on CENTOS devices, which caused the firewall to display high memory usage alerts even when sufficient memory was available.

## PAN-267328

Fixed an issue where the all_task process stopped responding, which caused the firewall to stop processing traffic.

## PAN-259853

Fixed an issue where, when the DHCP server was enabled for GlobalProtect, the commit error message was not properly displayed when **Any** was selected as the source interface in the service router configuration (**Device** > **Setup** > **Service** > **Service Router Configuration**).

## PAN-258039

Fixed an issue where the firewall displayed the incorrect rule name when a threat log was generated for Inline Cloud Analyzed CMD Injection Traffic Detection.