OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability

SecurityWeek reports that OpenSSL developers quietly fixed a denial-of-service issue dubbed “HollowByte” where specially crafted payloads trigger buffer pre-allocations that are not freed, allowing attackers to exhaust server memory. The fix has been applied upstream; operators should verify OpenSSL versions, apply the patched release, and monitor for abnormal memory consumption or repeated malformed connection payloads. Mitigations include upgrading to the patched OpenSSL, applying WAF/rate-limiting to limit malformed traffic, and reviewing logs/telemetry for signs of memory-exhaustion DoS.