>
    Strata Copilot
    PAN-OS 11.2.7-h10 Addressed Issues
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. PAN-OS 11.2.7 Known and Addressed Issues
    4. PAN-OS 11.2.7-h10 Addressed Issues
    Download PDF

    PAN-OS 11.2.7-h10 Addressed Issues

    Table of Contents

    PAN-OS 11.2.7-h10 Addressed Issues

    PAN-OSĀ® 11.2.7-h10 addressed issues.
    Issue ID
    Description
    PAN-310868
    Fixed an issue where PA Explicit proxy blocked ICMP packets from flowing towards Envoy for Geneve due to the router not camping MSS when the MTU was lower in the path.
    PAN-307901
    Fixed an issue where a leak in decryption counters caused resource exhaustion, which led to a GlobalProtect service outage.
    PAN-306502
    Fixed two issues that impacted TLSv1.2 or earlier sessions when the traffic matched a decryption policy rule with the no-decrypt action:
    • Connections failed when both HTTP header insertion (Objects > Security Profiles > URL Filtering > HTTP Header Insertion) and Send handshake messages to CTD for inspection (Device > Setup > Session > Decryption Settings > SSL Decryption Settings) were enabled.
    • New sessions failed due to software packet buffer resource depletion, which occurred when Log Successful SSL Handshake was disabled in the decryption policy rule and the decryption profile attached to the rule had both Block sessions with expired certificates and Block sessions with untrusted issuers disabled.
    PAN-306103
    (PA-3400 and PA-5400 Series firewalls only) Fixed an issue where the firewall dataplane frequently restarted when lockless QoS was enabled
    PAN-303959
    Fixed an issue where traffic was incorrectly identified as unknown-tcp/unknown-udp due to App-ID resource leak and eventually dropped.
    PAN-302767
    Fixed an issue where IPv6 IPsec WAN support was not available in Prisma Access.
    PAN-301222
    Fixed an issue where DNS Security logs incorrectly displayed a sinkhole action for benign DNS categories due to the firewall saving the drop or sinkhole action in session flags without discarding the session.
    PAN-300638
    (VM-Series firewalls only) Fixed an issue where the firewall stopped responding due to an out-of-bounds read when parsing TLS 1.3 clientHello messages with large TLS clientHello extensions where the supported_versions extension fell outside the first TCP segment.
    PAN-297295
    (VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where the firewall repeatedly restarted due to high packet rates on the synthetic path in DPDK mode.
    PAN-295803
    Addressed a memory leak issue under sc3 and automatic commit recovery (ACR) code path.
    PAN-294488
    Fixed an issue where certificate data was missing in decryption logs for No decrypt policy rules and TLS1.2 traffic after upgrading, and the Subject Common Name, Issuer Common Name, Certificate Start Date, Certificate End Date, Certificate Serial Number, and Certificate Fingerprint fields were blank in the decryption logs.
    PAN-283563
    Fixed an issue where the GlobalProtect gateway firewall intermittently failed to assign an IP address to GlobalProtect clients from the DHCP server, even after successfully receiving a DHCP offer. This occurred when the DHCP retry and timeout settings were overwritten due to parsing results being stored in the same variable, which caused the last gateway configuration to take effect.
    PAN-271438
    Fixed an issue where the firewall calculated available memory incorrectly on CENTOS devices, which caused the firewall to display high memory usage alerts even when sufficient memory was available.
    PAN-267328
    Fixed an issue where the all_task process stopped responding, which caused the firewall to stop processing traffic.
    PAN-259853
    Fixed an issue where, when the DHCP server was enabled for GlobalProtect, the commit error message was not properly displayed when Any was selected as the source interface in the service router configuration (DeviceSetupServiceService Router Configuration).
    PAN-258039
    Fixed an issue where the firewall displayed the incorrect rule name when a threat log was generated for Inline Cloud Analyzed CMD Injection Traffic Detection.

    © 2026 Palo Alto Networks, Inc. All rights reserved.