CVE-2024-3382: PAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted Packets

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-10 · updated 2026-06-17
Weakness: CWE-770

Description

A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually prevents the firewall from processing traffic. This issue applies only to PA-5400 Series devices that are running PAN-OS software with the SSL Forward Proxy feature enabled.

Affected products

Palo Alto Networks PAN-OS: from 10.2.0 before 10.2.7; from 11.0.0 before 11.0.4; from 11.1.0 before 11.1.2; 10.2.7-h1; 10.2.7 — fixed in 10.2.7, 11.0.4, 11.1.2
Palo Alto Networks PAN-OS: from 10.2.0 before 10.2.7-h3; from 11.0.0 before 11.0.4; from 11.1.0 before 11.1.2 — fixed in 10.2.7-h3, 11.0.4, 11.1.2

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.2.7, 11.0.4, 11.1.2; Palo Alto Networks PAN-OS 10.2.7-h3, 11.0.4, 11.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-3382 or the next vulnerability affects your stack