HollowByte Vulnerability in OpenSSL Allows a Denial of Service with an 11-Byte Packet

Security researchers have reported a vulnerability in OpenSSL dubbed HollowByte. It allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on servers that use this library.

What makes the vulnerability notable is that exploiting it requires a malicious packet just 11 bytes in size. That minimal amount of data turns out to be enough to trigger uncontrolled memory consumption on the targeted server.

OpenSSL remains one of the most widely used cryptographic libraries and is deployed across an enormous number of server applications and infrastructure solutions around the world. Vulnerabilities in a library like this potentially affect a significant number of systems.

Details about how HollowByte works, the affected OpenSSL versions and remediation recommendations remain limited for now. Companies using OpenSSL in their infrastructure should keep a close eye on the release of official security advisories and updates.

Source: Bleeping Computer