openssl news
4 stories
ZDI-26-577: Trend Micro VPN OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Trend Micro's TrendLife VPN product has been found to contain a local privilege escalation vulnerability, tracked as CVE-2026-67212, which could allow an attacker to execute arbitrary code with SYSTEM privileges. The flaw, identified as ZDI-26-577 (ZDI-CAN-29830), stems from an uncontrolled search path element in the OpenSSL configuration used by the VPN client.
OpenSSL Vulnerability Allows Memory Exhaustion via 11-Byte Payload
A denial-of-service vulnerability, dubbed "HollowByte," has been discovered in OpenSSL that allows remote, unauthenticated attackers to exhaust server memory and trigger denial-of-service attacks using a specially crafted 11-byte payload. The flaw was disclosed by Okta's Red Team on July 18, 2026.
OpenSSL Flaw Allows Denial-of-Service via Small TLS Requests
A denial-of-service vulnerability has been identified in OpenSSL, allowing attackers to disrupt service by sending small TLS requests. The flaw, internally dubbed "HollowByte," can be triggered with an 11-byte TLS request, leading to significant memory allocation issues on vulnerable servers.
HollowByte DDoS flaw bloats OpenSSL server memory
A denial-of-service vulnerability, dubbed HollowByte, has been identified in OpenSSL, allowing unauthenticated attackers to deplete server memory with minimal data transmission. The OpenSSL team has addressed the flaw in recent updates, though no CVE identifier has been assigned. Organizations are strongly advised to update their OpenSSL installations to a patched version.