CVE-2024-3382

PAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted Packets

Severity: High7.5CVSS 3.1, High
EPSS: 0.93%
Published: 10 Apr 2024
Updated: 17 Jun 2026

Description

Title, description and vendor guidance are quoted from the source records.

A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually prevents the firewall from processing traffic. This issue applies only to PA-5400 Series devices that are running PAN-OS software with the SSL Forward Proxy feature enabled.

Weakness: CWE-770, CWE-401

Known exploited

Not listed in CISA KEV as of the last check.

Exploit prediction

0.93% probability of exploitation in the next 30 days (percentile 59%).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the source states, per branch

Versions matched by Patcharo

Palo Alto Networks PAN-OSSource: Palo Alto Networks (CVE record)

Branch	Affected	Fixed in
11.1	>= 11.1.0, < 11.1.2	11.1.2
11.0	>= 11.0.0, < 11.0.4	11.0.4
10.2	>= 10.2.0, < 10.2.7-h3	10.2.7-h3

Versions not listed are stated unaffected by the vendor.

Workaround / Vendor remediation

Workaround · PAN-OS

You can mitigate this issue by disabling decryption on your firewalls. To temporarily disable SSL Decryption, refer to the administrator’s guide for your PAN-OS software (such as PAN-OS 11.1: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/decryption/temporarily-disable-ssl-decryption) . Additionally, to ensure that decryption remains disabled after a reboot, configure a policy-based decryption exclusion that excludes all traffic from being decrypted ( https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/decryption/decryption-exclusions/create-a-policy-based-decryption-exclusion) .

Vendor remediation · PAN-OS

This issue is fixed in PAN-OS 10.2.7-h3, PAN-OS 11.0.4, PAN-OS 11.1.2, and all later PAN-OS versions.

References

https://security.paloaltonetworks.com/CVE-2024-3382(opens in a new tab)

Provenance

Every fact on this page comes from the sources below. Nothing is written by an AI.

Palo Alto Networks (CVE record): Palo Alto Networks (CVE record) · 27 Sept 2026, 23:46 UTC · Parser patcharo-cve5/1.1.0
NVD: NVD · 27 Sept 2026, 23:44 UTC · Parser patcharo-nvd/1.0.0
FIRST EPSS: FIRST EPSS · 27 Sept 2026, 23:46 UTC · Parser patcharo-epss/1.0.0

Last verified: 28 Sept 2026, 02:31 UTC