CVE-2022-0023: PAN-OS: Denial-of-Service (DoS) Vulnerability in DNS Proxy

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-13 · updated 2026-06-17
Weakness: CWE-755

Description

An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-the-middle (MITM) to send specifically crafted traffic to the firewall that causes the service to restart unexpectedly. Repeated attempts to send this request result in denial-of-service to all PAN-OS services by restarting the device in maintenance mode. This issue does not impact Panorama appliances and Prisma Access customers. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.22; PAN-OS 9.0 versions earlier than PAN-OS 9.0.16; PAN-OS 9.1 versions earlier than PAN-OS 9.1.13; PAN-OS 10.0 versions earlier than PAN-OS 10.0.10; PAN-OS 10.1 versions earlier than PAN-OS 10.1.5. This issue does not impact PAN-OS 10.2.

Affected products

Palo Alto Networks PAN-OS: from 8.1.0 before 8.1.22; from 9.0.0 before 9.0.16; from 9.1.0 before 9.1.13; from 10.0.0 before 10.0.10; from 10.1.0 before 10.1.5 — fixed in 8.1.22, 9.0.16, 9.1.13, 10.0.10, 10.1.5
Palo Alto Networks PAN-OS: from 8.1 before 8.1.22; from 9.1 before 9.1.13; from 10.1 before 10.1.5; from 10.0 before 10.0.10; from 9.0 before 9.0.16 — fixed in 8.1.22, 9.1.13, 10.1.5, 10.0.10, 9.0.16

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 8.1.22, 9.0.16, 9.1.13, 10.0.10; Palo Alto Networks PAN-OS 8.1.22, 9.1.13, 10.1.5, 10.0.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-0023 or the next vulnerability affects your stack