openssl
OpenSSL Vulnerability Allows Memory Exhaustion via 11-Byte Payload
Okta's Red Team has identified a denial-of-service vulnerability in OpenSSL named HollowByte. A remote, unauthenticated attacker can exploit this flaw using an 11-byte payload to trigger excessive memory allocation on the server before the TLS handshake completes, leading to a denial of service. The vulnerability stems from OpenSSL's trust in the declared message size, which allows for large memory allocations based on untrusted input, and the issue is compounded by heap fragmentation preventing memory reuse.
OpenSSL Flaw Allows Denial-of-Service via Small TLS Requests
A denial-of-service vulnerability in OpenSSL, dubbed HollowByte, can be triggered by sending an 11-byte TLS request. This request causes unpatched servers, particularly those using glibc, to allocate up to 131 KB of memory that remains unavailable until the server process is restarted. The fix was released in June without specific disclosure.
HollowByte DDoS flaw bloats OpenSSL server memory
A vulnerability named HollowByte has been discovered that enables unauthenticated attackers to cause a denial-of-service on OpenSSL servers. The attack requires only a small, 11-byte malicious payload to trigger the condition, which reportedly causes server memory to bloat.