Security · 2h ago
OpenSSL HollowByte Bug Lets 11-Byte Request Freeze Server Memory
A 11-byte TLS request can cause unpatched OpenSSL servers to allocate up to 131 KB of memory that never gets freed on glibc systems. Okta's Red Team discovered the denial-of-service vulnerability, named HollowByte, and reported it. OpenSSL shipped the fix in June without a CVE, advisory, or changelog entry.
Meridian48 take
The silent patch raises questions about disclosure transparency, but the bug's limited impact on non-glibc systems may explain the low-key response.
Read the full reporting
OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests →
The Hacker News
openssldenial-of-service