OpenSSL Vulnerability Allows Memory Exhaustion via 11-Byte Payload

Okta's Red Team has identified a denial-of-service vulnerability in OpenSSL named HollowByte. A remote, unauthenticated attacker can exploit this flaw using an 11-byte payload to trigger excessive memory allocation on the server before the TLS handshake completes, leading to a denial of service. The vulnerability stems from OpenSSL's trust in the declared message size, which allows for large memory allocations based on untrusted input, and the issue is compounded by heap fragmentation preventing memory reuse.