[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8xai3oJeX1W4ERUeMk4imDnlIMTMhi-dW45QI6rE2IY":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"f16aa8d1-c32b-427c-8b2f-3925683e9141","OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability","openssl-silently-fixes-hollowbyte-dos-vulnerability-cec3ac","Attackers could send waves of malicious payloads to trigger buffer pre-allocations that are not freed, exhausting server memory. The post OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability appeared first on SecurityWeek.","A denial-of-service vulnerability dubbed 'HollowByte' in OpenSSL allowed attackers to exhaust server memory by sending small malicious payloads that triggered unvalidated buffer allocations. This issue impacted numerous applications and databases relying on OpenSSL. Patches have been silently released in recent OpenSSL versions, which now validate buffer sizes more rigorously.","OpenSSL silently fixes 'HollowByte' DoS vulnerability allowing memory exhaustion.","https:\u002F\u002Fwww.securityweek.com\u002Fopenssl-silently-fixes-hollowbyte-dos-vulnerability\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F10\u002FOpenSSL-communications-traffic.jpg","2026-07-20T12:32:40+00:00","2026-07-20T14:00:14.78162+00:00",8,[17,20,23,26],{"name":18,"type":19},"OpenSSL","product",{"name":21,"type":22},"HollowByte","campaign",{"name":24,"type":25},"Okta","vendor",{"name":27,"type":28},"GNU C Library","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,37],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[],[24,18],{"controls":45,"vendors":129},[46,75,100],{"slug":47,"name":48,"problem":49,"products":50},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":76,"name":77,"problem":78,"products":79},"patch-management","Automated patch management","Known holes get closed in days, not months.",[80,88,92],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":76,"product_name":89,"url":90,"description":91},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":101,"name":102,"problem":103,"products":104},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[130],{"slug":131,"name":24,"logo_path":132,"roles":133},"okta","\u002Fvendor-logos\u002Fokta.png",[134],"reported_by",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":149},"openssl-hollowbyte-dos-flaw-highlights-silent-patching-risks","OpenSSL 'HollowByte' DoS Flaw Highlights Silent Patching Risks","The 'HollowByte' vulnerability in OpenSSL allowed attackers to exhaust server memory through malicious payloads that bypassed buffer size validation, enabling denial-of-service attacks with minimal effort. Because the fix was released silently — without a prominent CVE announcement or security advisory — many organizations relying on OpenSSL-dependent applications and databases may remain unpatched and unaware of the risk. This illustrates the dual danger of unvalidated input handling in widely-used cryptographic libraries and the operational blind spots created when vendors deprioritize transparent vulnerability disclosure. Given OpenSSL's pervasive role in securing web servers, databases, and enterprise applications, even a single unpatched instance can serve as a critical availability target.",[140,141,142,143,144,145,146,147,148],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SI-10: Information Input Validation","NIST SP 800-53 SA-12: Supply Chain Protection","NIST CSF ID.AM-2: Software platforms and applications are inventoried","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","ITIL Change Management: Emergency Change Procedures","OWASP A06:2021 – Vulnerable and Outdated Components",{}]