A vulnerability dubbed HollowByte allows unauthenticated attackers to trigger a denial-of-service condition on OpenSSL servers using a malicious payload of just 11 bytes, according to security researchers. The flaw affects the widely used cryptographic library that underpins a significant portion of encrypted internet traffic.
The attack exploits a memory allocation issue in certain OpenSSL configurations, causing server memory to balloon when processing specially crafted handshake messages. An attacker can consume excessive server resources with minimal bandwidth, potentially taking servers offline or degrading performance to unacceptable levels.
The vulnerability has been assigned a CVSS score that reflects its potential for disruption. Organizations running OpenSSL-based services are advised to update to the latest patched version as soon as possible. The issue affects both server and client implementations, though servers are the more likely target due to their public-facing nature.
OpenSSL is one of the most critical pieces of internet infrastructure, used by web servers, email servers, VPNs, and countless other applications to implement TLS encryption. Vulnerabilities in OpenSSL have historically had widespread impact, as was the case with the Heartbleed bug in 2014 and numerous other high-severity flaws discovered in subsequent years.
The HollowByte discovery highlights the ongoing challenge of securing low-level cryptographic software that runs on millions of systems worldwide. While the OpenSSL project maintains an active security response process, the sheer ubiquity of the library means that even relatively low-severity flaws can have significant real-world impact when exploited at scale.
This article was adapted from Bleeping Computer. Read the original here.
