BugZero | Palo Alto Networks BugID PAN-163800 - Fixed an intermittent issue where the presence of ...

Palo Alto Networks - Defect ID: PAN-163800

Fixed an intermittent issue where the presence of an Anti-Spyware profile in a Security policy rule that matched DNS traffic caused DNS responses to be malformed in transit.

Palo Alto Networks - Defect ID: PAN-163800

Fixed an intermittent issue where the presence of an Anti-Spyware profile in a Security policy rule that matched DNS traffic caused DNS responses to be malformed in transit.

Last updated on August 6th, 2025

BugZero Risk Score
9.7 High

Overall: 9.7

Severity: 10.0

Community: 7.2

Lifecycle: 10.0

What is the BugZero Risk Score?

Palo Alto Networks Integration

Learn more about where this data comes from

Palo Alto Networks Integration

Learn more

Bug Scrub Advisor

Streamline upgrades with automated vendor bug scrubs

Bug Scrub Advisor

Learn more

BugZero Enterprise

Wish you caught this bug sooner? Get proactive today.

BugZero Enterprise

Learn more

Bug Details

Views: 2

Description

Overview

Fixed an intermittent issue where the presence of an Anti-Spyware profile in a Security policy rule that matched DNS traffic caused DNS responses to be malformed in transit.

Impact

dns response is corrupted

root_cause

code of license check and TTL modification had a bug to handle DNS response

workaround

Remove anti-spyware that contains dns security profile

Change history

No changes to display

2025-07-22 Added: 9.1.10, 10.0.5, 9.1.6, 9.1.4, 10.0.4, 9.1.5, 10.1.0, 9.1.0, 10.0.3, 9.1.7, 9.1.3, 9.1.9, 9.1.2, 10.0.1, 9.1.1, 9.1.8, 10.0.0, 10.0.6, 10.0.2

Relevant Products

Click on a version to see all relevant bugs

Affected versions:9.1.5, 10.0.4, 9.1.2, 9.1.3, 9.1.6, 10.0.3, 10.0.2, 10.0.5, 10.0.0, 10.0.1, 10.1.0, 9.1.4, 9.1.7, 9.1.8, 9.1.9, 10.0.6, 9.1.1, 9.1.0, 9.1.10

Fixed versions: 9.1.11, 10.1.1, 10.0.7

Relevant Products

Click on a version to see all relevant bugs

Affected versions:9.1.5, 10.0.4, 9.1.2, 9.1.3, 9.1.6, 10.0.3, 10.0.2, 10.0.5, 10.0.0, 10.0.1, 10.1.0, 9.1.4, 9.1.7, 9.1.8, 9.1.9, 10.0.6, 9.1.1, 9.1.0, 9.1.10

Fixed versions: 9.1.11, 10.1.1, 10.0.7

Top Palo Alto Networks Defects

6.3Defect ID: PAN-214430
Fixed an issue where some commands did not have executable permissions.
6.3Defect ID: PAN-298460
( Panorama appliances in HA configurations on Microsoft Azure environments only ) Fixed an issue on the web interface where the plugin versions that were displayed when hovering the cursor over the Green Match icon were inconsistent even though the Panorama web interface reported the versions as matching.
6.3Defect ID: PAN-287713
Fixed an issue on Panorama where, after uninstalling a plugin, commit validation failed with the error message interface '-' is not a valid reference due to cloud service plugin configuration errors.
6.3Defect ID: PAN-305301
Fixed an issue where GlobalProtect notifications in tunnels caused processes to stop responding and the dataplane to restart due to the session lookup returning an incorrect session, which resulted in the data being sent through the wrong tunnel.
6.3Defect ID: PAN-296598
Fixed an issue where EAL logs were not forwarded to the IoT Security dashboard when the proxy server password contained special characters.

Ready to prevent the next vendor outage?

Get a demo

Palo Alto Networks - Defect ID: PAN-163800

Fixed an intermittent issue where the presence of an Anti-Spyware profile in a Security policy rule that matched DNS traffic caused DNS responses to be malformed in transit.

Palo Alto Networks - Defect ID: PAN-163800

Fixed an intermittent issue where the presence of an Anti-Spyware profile in a Security policy rule that matched DNS traffic caused DNS responses to be malformed in transit.

Last updated on August 6th, 2025

BugZero Risk Score9.7 High

Bug Details

Overview

Impact

root_cause

workaround

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

Links

BugZero Risk Score
9.7 High