[5.4] Patch 4 - April 20, 2026

Fortanix Data Security Manager (DSM) 5.4.2940.3472 release provides an overview of resolved issues.

WARNING

• If you want to upgrade Fortanix DSM to version 5.4.2940.3472, your current DSM version must be at least 5.0 patch 5*, 5.2 patch 2*, or 5.4 patch 2*.

• Downgrade from 5.4.2940.3472 to any prior version is not supported due to Kernel upgrades.

• The security fix included in this patch release may cause a performance degradation and increased operation latency when executing requests from client applications. The impact will vary across operations and cryptographic algorithms

*The minimum required version is specific to your current major.minor version. You must first upgrade to the required patch level within your current version before proceeding to version 5.4.2940.3472.

Note

• The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix support if you are planning an upgrade.

• The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.

• If your Fortanix DSM version is 5.2 or later, then the HSM Gateway version must also be 5.2 or later. Similarly, if the HSM Gateway version is 5.2 or later, then your Fortanix DSM version must be 5.2 or later.

1. Bug Fixes

• Fixed DSM enclave Out of Memory (OOM) panics caused by memory allocation failures under high load specific to Azure Log Analytics integration (JIRA: PROD-11251).

2. Security Fixes

• Fixed a security issue to improve session management and overall account protection (JIRA: PROD-11225).

• Fixed an issue in the Lua plugin environment to improve isolation and prevent unintended behavior from plugin code (JIRA: PROD-11222).

• Fixed an issue where certain validation checks for enclave build artifacts were not consistently executed (JIRA: PROD-11281).

2. Known Issues

• When using an external load balancer configured with HTTP-based health checks on port 4445 (for example, GET /sys/v1/health or /health), the endpoint returns an HTTP 404 (Not Found) response starting from DSM version 5.2.

• On VMware nodes, /etc/resolv.conf may be cleared after a reboot, resulting in missing nameserver entries. Although the /etc/network/interfaces configuration is correct, any manual updates to /etc/resolv.conf are overwritten after a reboot or when the CoreDNS pod restarts (JIRA: RODE-373).

  Workaround:

  Perform the following steps:

  1. Run sudo apt purge netplan.io.

  2. If the file is removed or CoreDNS continues to have issues, manually update the nameserver entries in /etc/resolv.conf.

  3. Restart networking: sudo systemctl restart networking.

  4. Delete the CoreDNS pods to allow them to restart.

• The sudo get_csrs --rotate workflow does not support changing existing DNS hostnames configured in the service URL or Subject Alternative Name (SAN) entries (JIRA: PROD-9542). 

  This issue occurs when:

  • get_csrs --rotate is used to generate CSRs, and

  • install_certs --rotate is used to install certificates where existing DNS/SAN hostnames (single or multiple) are modified or replaced.

  For example, if the existing service URL hostname is dsm.fortanix.net, changing it to a different hostname while using certificate rotation is not supported. 

  Workaround:

  • Do not use the --rotate option when changing existing DNS/SAN hostnames.

  • If certificate rotation is required with SAN certificates, retain the existing DNS entries and append additional DNS entries instead of replacing or modifying the current ones.

For a complete list of new features, enhancements to existing features, other improvements, bug fixes, and known issues, refer to the full description of the DSM 5.4 release notes.