OpenSSL DoS Vulnerability Lets Remote Attackers Exhaust Server Memory With an 11-Byte Payload

A newly disclosed OpenSSL DoS vulnerability dubbed “HollowByte” lets a remote unauthenticated attacker trigger unvalidated buffer pre-allocation from an 11-byte payload, causing heavy heap fragmentation, persistent RSS growth, and service disruption across many OpenSSL-using products; OpenSSL fixed the issue by switching to incremental buffer growth in v4.0.1 with backports, and organizations should prioritize upgrading internet-facing systems.