[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fO6lhoXR9XNLd9N2PVU7tulaE8RH6Y2GtQpKc70FqEu8":3},{"article":4,"iocs":37,"watch_terms":45,"solutions":46,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"9a6bad82-bbca-419d-9990-aeaa86aa32a7","OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests","openssl-hollowbyte-flaw-could-freeze-server-memory-with-11-byte-tls-requests-d32c62","Eleven bytes will make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On the glibc systems Okta tested, that memory is gone until the process restarts. OpenSSL shipped the HollowByte fix in June with no CVE, no advisory, and no changelog entry pointing at it. Okta's Red Team, which reported the denial-of-service bug and named it, published the","OpenSSL shipped a fix in June 2026 for HollowByte, a denial-of-service vulnerability that allows attackers to freeze server memory by sending crafted TLS handshake headers claiming large message bodies that never arrive. The flaw, reported by Okta's Red Team, causes OpenSSL to allocate up to 131 KB per connection, and on glibc systems the memory fragments and is not reclaimed until process restart, enabling attackers to exhaust system memory without triggering connection limits. OpenSSL classified this as a \"bug or hardening\" fix rather than a vulnerability, omitting CVE assignment, advisory, and changelog documentation.","OpenSSL HollowByte flaw allows 11-byte TLS requests to exhaust server memory without CVE assignment.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fopenssl-hollowbyte-flaw-could-freeze.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhk66eU1Srifu4Rdpf7MZDjg3GdNMtQK6ZW-F283kxhZ7Z0W_8nWNJynZiQ7n0ov9OLNm315P4942h3-unMI0WZ1-LH8tdQ6sv2o6q0TxKT-bVKewzkQULKKXSJOee_oANuI3YquoDgSPHsPeXEdQcFRoy8czRQimH_f0sNHJ55-5LA153sQgUPkpBBEVE\u002Fs1600\u002Fopenssl.jpg","2026-07-17T20:20:53+00:00","2026-07-17T22:00:14.259672+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"OpenSSL","product",{"name":21,"type":22},"OpenSSL Software Foundation","vendor",{"name":24,"type":25},"glibc","technology",{"name":27,"type":25},"NGINX",{"name":29,"type":30},"Okta Red Team","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[],[38,42],{"type":39,"value":40,"context":41},"cve","CVE-2025-66199","Related TLS 1.3 certificate-compression buffer growth issue, rated Low",{"type":39,"value":43,"context":44},"CVE-2026-34183","Related QUIC PATH_CHALLENGE unbounded memory growth, rated Moderate",[21,18],{"controls":47,"vendors":134},[48,76,105],{"slug":49,"name":50,"problem":51,"products":52},"patch-management","Automated patch management","Known holes get closed in days, not months.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":49,"product_name":73,"url":74,"description":75},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":77,"name":78,"problem":79,"products":80},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":106,"name":107,"problem":108,"products":109},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-firewall","Sophos Firewall","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fnext-gen-firewall","Next-generation firewall with intrusion prevention.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","quantum-firewall","Quantum Force firewalls","https:\u002F\u002Fwww.checkpoint.com\u002Fquantum\u002Fnext-generation-firewall\u002F","Next-generation firewalls with threat prevention.",[135],{"slug":136,"name":137,"logo_path":138,"roles":139},"okta","Okta","\u002Fvendor-logos\u002Fokta.png",[140],"reported_by",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":156},"openssl-hollowbyte-flaw-enables-memory-exhaustion-via-tiny-tls-requests","OpenSSL HollowByte Flaw Enables Memory Exhaustion via Tiny TLS Requests","The HollowByte vulnerability exposes a critical resource management flaw in OpenSSL where malformed TLS handshake headers trick the server into pre-allocating up to 131 KB of memory per connection — memory that is never released on glibc-based systems until a process restart. An attacker needs only 11 bytes per request to trigger this, making denial-of-service attacks cheap and connection-rate limits ineffective as a defense. Compounding the risk, OpenSSL classified the fix as a 'hardening' change rather than a vulnerability, bypassing CVE assignment and formal advisories — meaning many organizations relying on vulnerability feeds alone would never know to patch. This highlights the danger of vendor classification decisions that obscure security impact and underscores why proactive patch tracking beyond CVE databases is essential.",[146,147,148,149,150,151,152,153,154,155],"CIS Control 7.1 – Establish and Maintain a Vulnerability Management Process","CIS Control 7.3 – Perform Automated Operating System Patch Management","CIS Control 12.2 – Establish and Maintain a Secure Network Architecture","NIST SP 800-40 Rev. 4 – Guide to Enterprise Patch Management","NIST SI-2 – Flaw Remediation","NIST SI-10 – Information Input Validation","NIST SC-5 – Denial of Service Protection","NIST CA-7 – Continuous Monitoring","ITIL – Change and Release Management (patch deployment workflows)","NIST SSDF PW.5 – Create Source Code by Adhering to Secure Coding Practices",{}]