BugZero | Palo Alto Networks BugID PAN-136347 - Fixed an issue wherer DNS proxy TCP connections we...

OPERATIONAL DEFECT DATABASE

...

BugZero | Palo Alto Networks BugID PAN-136347 - Fixed an issue wherer DNS proxy TCP connections we...

Palo Alto Networks - Defect ID: PAN-136347

Fixed an issue wherer DNS proxy TCP connections were processed incorrectly, which caused a process (`dnsproxy`) to stop responding.

Palo Alto Networks - Defect ID: PAN-136347

Fixed an issue wherer DNS proxy TCP connections were processed incorrectly, which caused a process (`dnsproxy`) to stop responding.

Last updated on August 6th, 2025

BugZero Risk Score
9.3 High

Overall: 9.3

Severity: 10.0

Community: 3.7

Lifecycle: 10.0

What is the BugZero Risk Score?

Palo Alto Networks Integration

Learn more about where this data comes from

Palo Alto Networks Integration

Learn more

Bug Scrub Advisor

Streamline upgrades with automated vendor bug scrubs

Bug Scrub Advisor

Learn more

BugZero Enterprise

Wish you caught this bug sooner? Get proactive today.

BugZero Enterprise

Learn more

Bug Details

Description

Overview

Fixed an issue wherer DNS proxy TCP connections were processed incorrectly, which caused a process (`dnsproxy`) to stop responding.

Impact

dnspropyd crash / high CPU

root_cause

tcp_wait_timer on the daemon didn't cleared correctly

workaround

Workaround is to disable TCP connection through DNSproxy daemon, to safely avoid any ability issues with proxied TCP requests.

Change history

No changes to display

2025-07-22 Added: 8.1.10, 8.1.4, 8.1.15, 8.1.17, 9.0.0, 9.0.6, 9.0.10, 8.1.12, 8.1.8, 9.0.13, 9.1.6, 9.1.4, 8.1.13, 8.1.5, 9.0.12, 10.0.4, 8.1.18, 9.1.5, 8.1.14, 8.1.1, 9.1.0, 10.0.3, 9.0.3, 9.1.7, 9.1.3, 8.1.6, 9.1.2, 9.0.5, 8.1.2, 8.1.9, 8.1.16, 9.0.11, 10.0.1, 9.1.1, 9.1.8, 10.0.0, 9.0.2, 9.0.4, 8.1.3, 9.0.7, 9.0.1, 10.0.2, 9.0.8, 8.1.7, 8.1.11, 9.0.9, 8.1.0

Links

Original Vendor Announcement

Relevant Products

Click on a version to see all relevant bugs

Affected versions:8.1.13, 8.1.4, 9.0.9, 8.1.11, 9.0.4, 9.1.5, 10.0.4, 9.0.8, 9.0.0, 9.1.2, 9.1.3, 9.1.6, 10.0.3, 10.0.0, 8.1.6, 9.0.2, 10.0.1, 9.0.6, 10.0.2, 9.0.13, 8.1.0, 8.1.10, 8.1.2, 8.1.7, 8.1.14, 8.1.1, 9.1.4, 9.0.5, 8.1.16, 9.1.7, 9.0.7, 9.1.8, 8.1.9, 8.1.18, 8.1.15, 9.0.11, 8.1.17, 8.1.8, 8.1.5, 9.0.12, 9.0.1, 9.1.1, 9.0.10, 9.1.0, 8.1.3, 9.0.3, 8.1.12

Fixed versions: 10.0.5, 9.0.14, 8.1.19, 9.1.9

Relevant Products

Click on a version to see all relevant bugs

Fixed versions: 10.0.5, 9.0.14, 8.1.19, 9.1.9

Top Palo Alto Networks Defects

6.3Defect ID: PAN-289383
( PA-800 series firewalls only ) Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Workaround: Enable auto-negotiation on the connected peer firewall.
6.3Defect ID: PAN-271438
Fixed an issue where the firewall calculated available memory incorrectly on CENTOS devices, which caused the firewall to display high memory usage alerts even when sufficient memory was available.
6.3Defect ID: PAN-281776
Fixed an issue on the Panorama web interface where the error message PPPoEv6 Client Interface cannot be enabled with DHCPv6 client was generated when overriding aggregate interfaces even when no DHCPv6 or PPPoE was configured.
6.3Defect ID: PAN-260661
Fixed an issue where daily email reports generated from the custom report did not display the report details in PDF or CSV files.
6.3Defect ID: PAN-294179
On the page, some commit versions might display incorrect or missing data. Fields such as, , , and might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters.

Palo Alto Networks Integration

Learn more about where this data comes from

Palo Alto Networks Integration

Learn more

Bug Scrub Advisor

Streamline upgrades with automated vendor bug scrubs

Bug Scrub Advisor

Learn more

BugZero Enterprise

Wish you caught this bug sooner? Get proactive today.

BugZero Enterprise

Learn more

Ready to prevent the next vendor outage?

Get a demo

OPERATIONAL DEFECT DATABASE

Palo Alto Networks - Defect ID: PAN-136347

Fixed an issue wherer DNS proxy TCP connections were processed incorrectly, which caused a process (`dnsproxy`) to stop responding.

Palo Alto Networks - Defect ID: PAN-136347

Fixed an issue wherer DNS proxy TCP connections were processed incorrectly, which caused a process (`dnsproxy`) to stop responding.

Last updated on August 6th, 2025

BugZero Risk Score9.3 High

Bug Details

Overview

Impact

root_cause

workaround

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

BugZero Risk Score
9.3 High