HollowByte: OpenSSL DoS Vulnerability Exploits Tiny Payloads to Cripple Servers A newly disclosed denial-of-service (DoS) vulnerability, dubbed HollowByte, allows unauthenticated attackers to exhaust server memory with just an 11-byte malicious payload targeting OpenSSL. The flaw, silently patched by the OpenSSL team, affects widely used versions of the library, which underpins secure communications for web servers, databases, and programming languages. ### How HollowByte Works Researchers from Okta’s Red Team revealed that vulnerable OpenSSL versions allocate memory based on a 4-byte header in TLS handshake messages, which declares the size of incoming data before verifying the actual payload. Attackers exploit this by sending an 11-byte input with a falsified header claiming a much larger message will follow. The server reserves the specified memory, then hangs indefinitely waiting for data that never arrives. By repeating this across multiple connections, attackers force the server to allocate excessive memory. While OpenSSL frees buffers when connections drop, the GNU C Library (glibc) retains small-to-medium allocations for reuse, leading to heap fragmentation. The server’s Resident Set Size (RSS) a measure of active memory balloons uncontrollably, even after the attack stops. The only recovery method is a full process restart. ### Impact and Affected Systems OpenSSL is embedded in critical software, including: - Web servers (NGINX, Apache) - Programming runtimes (Node.js, Python, Ruby, PHP) - Databases (MySQL, PostgreSQL) - Most Linux distributions (pre-installed for TLS encryption) Okta’s tests on NGINX demonstrated that low-resource environments can be completely depleted of memory, while high-capacity servers may lose up to 25% of available RAM all while attack traffic remains below typical security alert thresholds. Though DoS flaws are less severe than remote code execution vulnerabilities, they can cause operational disruptions and reputational harm. ### Patch and Mitigation The OpenSSL team addressed HollowByte as a "hardening fix" rather than a formal security vulnerability, but the issue has been resolved in: - OpenSSL 4.0.1 - Backported to 3.6.3, 3.5.7, 3.4.6, and 3.0.21 The fix modifies memory allocation to ignore header claims and expand buffers only when data arrives. Organizations are advised to upgrade OpenSSL packages immediately to prevent exploitation.

OpenSSL Patches 18 Vulnerabilities, Including High-Severity Remote Code Execution Flaw OpenSSL has released updates addressing 18 vulnerabilities, among them a high-severity heap use-after-free bug (CVE-2026-45447) that could enable remote code execution. The flaw, discovered by a California-based researcher in collaboration with Claude AI and Anthropic Research, affects PKCS#7 signature verification when processing maliciously crafted PKCS#7 or S/MIME signed messages. The vulnerability occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, causing OpenSSL to incorrectly free a caller-owned BIO during PKCS7_verify(). Exploitation could lead to heap corruption, process crashes, or remote code execution. In addition to the high-severity issue, the patches fix moderate- and low-severity flaws that could allow decryption of encrypted communications, DoS attacks, certificate forgery, private key recovery, and arbitrary code execution. One medium-severity weakness enables attackers to bypass authentication by tricking systems into accepting fake certificates with a 1-in-256 success rate. Anthropic researcher Alex Gaynor reported six of the patched vulnerabilities, suggesting potential involvement of the company’s Mythos AI model in identifying the flaws. High-severity OpenSSL vulnerabilities remain rare this is only the second such flaw patched in 2026, following a sensitive data exposure issue resolved in April. The updates underscore the ongoing risks in widely used cryptographic libraries, particularly for systems relying on PKCS#7 and S/MIME verification. Organizations using OpenSSL are advised to apply the patches promptly.

OpenSSL Patches Seven Vulnerabilities, Including Moderate-Severity Data Leak Flaw OpenSSL has released updates addressing seven vulnerabilities, one of which CVE-2026-31790 could allow attackers to access sensitive data. Classified as moderate severity, the flaw affects applications using RSASVE key encapsulation by failing to verify encryption success, potentially exposing uninitialized memory buffers containing residual sensitive data from prior processes. The vulnerability impacts OpenSSL versions 3.6, 3.5, 3.4, 3.3, and 3.0, while 1.0.2 and 1.1.1 remain unaffected. The remaining six flaws are rated low severity, with most enabling denial-of-service (DoS) attacks via application crashes. Two could theoretically permit arbitrary code execution, though one requires an uncommon OpenSSL configuration, and the other involves a 1GB X.509 certificate making exploitation impractical in most cases. This follows a January update that fixed 12 vulnerabilities, including a high-severity remote code execution (RCE) flaw. Notably, high-severity OpenSSL vulnerabilities have become rare, with only one reported in 2025. The latest patches reinforce OpenSSL’s ongoing efforts to mitigate risks in widely used cryptographic libraries.