CVE-2024-3382 is a high severity denial of service in Palo Alto Networks PAN-OS. It affects only specific versions and configurations, listed below. Palo Alto Networks rates it CVSS 8.2, while the NVD record shows 7.5. Palo Alto Networks lists fixes in PAN-OS 10.2.7-h3, 11.0.4 and 11.1.2.
What's affected
The advisory lists PAN-OS 11.1 before 11.1.2, PAN-OS 11.0 before 11.0.4, and PAN-OS 10.2 before 10.2.7-h3. Only PA-5400 Series devices that run with the SSL Forward Proxy decryption feature enabled are exposed. The record describes a memory leak that a burst of crafted packets can trigger, until the firewall can no longer process traffic.
The advisory scope is narrow. If you do not run a PA-5400 Series device, or you do not have SSL Forward Proxy enabled, you are not exposed to this one.
The weakness classes are CWE-770 and CWE-401, which covers memory leak and resource exhaustion. The NVD record gives the score as 7.5. The Palo Alto Networks advisory gives 8.2. Both put it in the high band. I did not confirm why the numbers differ, so I report both. When you report this internally, say both numbers and name the source of each.
The advisory lists a workaround. Disable decryption. To keep it disabled after a reboot, add a policy based decryption exclusion that covers all traffic. Turning off decryption reduces your inspection coverage, so treat it as a short term step.
How to check if you're exposed
- Confirm the hardware model. Only the PA-5400 Series is affected.
- Check whether SSL Forward Proxy decryption is configured in your decryption policy.
- Check the PAN-OS version against the affected ranges: 10.2 before 10.2.7-h3, 11.0 before 11.0.4, and 11.1 before 11.1.2.
- If any of the three checks comes back clear, you are not exposed to this CVE.
What to do now
- Identify the PAN-OS version on each firewall, using the web interface dashboard or the
show system infocommand in the CLI. - Upgrade to PAN-OS 10.2.7-h3, 11.0.4 or 11.1.2, or a later release on your branch.
- Apply any workaround the advisory lists while you wait for a change window.
- Schedule the upgrade through your normal change control, testing high availability pairs one member at a time.
- Watch device logs for unexpected restarts and system messages about maintenance mode.
- Record the advisory number and the fixed version in your vulnerability tracker.
Why it matters
A memory leak is a slow resource problem. Each packet in a crafted burst leaves a little memory behind, and memory that is never returned eventually runs out. The record says the result is that the firewall can no longer process traffic. The classes are CWE-770, allocation of resources without limits, and CWE-401, missing release of memory after its useful life.
Firewalls sit on the path of all traffic, which is why availability flaws in them matter more than the same flaw in an ordinary server. A device that reboots or stops forwarding takes the network segment with it. The advisory says Palo Alto Networks is not aware of any malicious exploitation, and the record does not mark the flaw as a CISA Known Exploited Vulnerability. That is a reason to patch on schedule, not a reason to wait.
Quick check
What is the fixed version for CVE-2024-3382?
The advisory lists PAN-OS 10.2.7-h3, 11.0.4 and 11.1.2 as fixed, and all later versions. Confirm against the advisory before you plan the change.
Is CVE-2024-3382 exploited in the wild?
The advisory says Palo Alto Networks is not aware of any malicious exploitation, and the record does not mark it as a CISA KEV entry. Check the advisory again before your patch window, since that statement can change.
Sources
Last reviewed: 19 October 2026.
