BugZero | Palo Alto Networks BugID PAN-283004 - Fixed an issue where the firewall bypassed Content...

Palo Alto Networks - Defect ID: PAN-283004

Fixed an issue where the firewall bypassed Content Threat Detection (CTD) for sessions with STARTTLS large client hello out-of-order with No Decrypt.

Palo Alto Networks - Defect ID: PAN-283004

Fixed an issue where the firewall bypassed Content Threat Detection (CTD) for sessions with STARTTLS large client hello out-of-order with No Decrypt.

Last updated on March 24th, 2026

BugZero Risk Score
6.3 Medium

Overall: 6.3

Severity: 6.4

Community: 3.7

Lifecycle: 10.0

What is the BugZero Risk Score?

Palo Alto Networks Integration

Learn more about where this data comes from

Palo Alto Networks Integration

Learn more

Bug Scrub Advisor

Streamline upgrades with automated vendor bug scrubs

Bug Scrub Advisor

Learn more

BugZero Enterprise

Wish you caught this bug sooner? Get proactive today.

BugZero Enterprise

Learn more

Bug Details

Description

The earliest recollection of this bug is traced back to PAN-OS 11.1.11 - March 24, 2026. This bug is fixed in PAN-OS versions 11.2.8, 11.1.11. Fixed an issue where the firewall bypassed Content Threat Detection (CTD) for sessions with STARTTLS large client hello out-of-order with No Decrypt. For more information: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-11-known-and-addressed-issues/pan-os-11-1-11-addressed-issues https://docs.paloaltonetworks.com/pan-os/11-2/pan-os-release-notes/pan-os-11-2-8-known-and-addressed-issues/pan-os-11-2-8-addressed-issues

Change history

No changes to display

Top Palo Alto Networks Defects

6.3Defect ID: PAN-271810
Fixed an issue where auto-negotiation advertised and negotiated 10/100 half and full duplex.
6.3Defect ID: PAN-266589
Fixed an issue where the firewall was unable to generate a tech support file when management server debug was disabled.
6.3Defect ID: PAN-268522
Fixed an issue where the firewall failed to connect to the update server with a customized service route when the source interface was set to MGT and the source address was set as IPv4.
6.3Defect ID: PAN-293842
Fixed an issue where the hybrid-SWG service proxy stopped working after upgrading to PAN-OS 11.1.6-h13 due to the firewall failing to establish the listening interface.
6.3Defect ID: PAN-283004
Fixed an issue where the firewall bypassed Content Threat Detection (CTD) for sessions with STARTTLS large client hello out-of-order with No Decrypt.

Ready to prevent the next vendor outage?

Get a demo

Palo Alto Networks - Defect ID: PAN-283004

Fixed an issue where the firewall bypassed Content Threat Detection (CTD) for sessions with STARTTLS large client hello out-of-order with No Decrypt.

Palo Alto Networks - Defect ID: PAN-283004

Fixed an issue where the firewall bypassed Content Threat Detection (CTD) for sessions with STARTTLS large client hello out-of-order with No Decrypt.

Last updated on March 24th, 2026

BugZero Risk Score6.3 Medium

Bug Details

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

BugZero Risk Score
6.3 Medium