OpenSSL “HollowByte” DoS Flaw Lets Attackers Exhaust Server Memory with an 11‑Byte Payload
What Happened – Researchers from Okta disclosed a new denial‑of‑service vulnerability in OpenSSL (no CVE assigned). An unauthenticated attacker can send an 11‑byte TLS handshake that declares a far larger payload, causing the server to allocate excessive memory and eventually stall. The flaw is fixed in the latest OpenSSL releases and back‑ported to older branches.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a gap in the Availability domain of SOC 2 (CC6.1) where controls must ensure services remain operational under attack.
- Highlights the need for continuous control monitoring of third‑party libraries and timely patch management as audit evidence.
- Provides a concrete example of why control mapping and automated evidence collection are essential to prove compliance with change‑management and vulnerability‑remediation policies.
Who Is Affected – Any organization that runs OpenSSL‑based services: web servers (NGINX, Apache), language runtimes (Node.js, Python, Ruby, PHP), and databases (MySQL, PostgreSQL) across cloud, SaaS, and on‑prem environments.
Recommended Actions
- Inventory all assets that embed OpenSSL and verify version numbers.
- Deploy the patched OpenSSL release (or back‑ported fix) immediately.
- Update your change‑management and patch‑tracking processes; capture patch‑deployment evidence for SOC 2 audits.
- Implement continuous monitoring of memory usage and service health to detect abnormal RSS growth.
- Document the remediation steps in your control‑mapping repository to close the availability control gap.
Source: BleepingComputer
Technical Notes – The flaw stems from OpenSSL allocating the declared handshake length before validating the payload size, leading to heap fragmentation on glibc‑based systems. No authentication is required; the attack works over a standard TLS handshake. The only recovery is a process restart. Source: same as above