Do Son 
TL;DR
The Okta Red Team recently found a severe crash flaw in a core secure library. A remote attacker can freeze server memory by sending a tiny bad payload. The OpenSSL HollowByte vulnerability forces the system into an out-of-memory state without any prior login.
Why It Matters
This severe defect threatens vital web servers on a global scale. An attacker only needs eleven bytes of data to crash a host. Also, normal connection limits fail to block this specific OpenSSL DoS attack. Network filters cannot catch the threat because the traffic volume remains very low. The Okta report does not provide an exact number of affected setups. However, this core code powers popular web servers like NGINX and Apache. It also supports many coding languages and databases. Currently, no active attacks in the wild have been confirmed. Still, security teams must act fast to secure their network borders.
How the Attack Works
The attack targets the first secure greeting step. A bad client connects and sends a crafted message header. This fake header falsely claims a massive incoming message body. As a result, the target software sets aside up to 131 kilobytes of memory early. The attacker then drops the link after sending only eleven bytes. The server frees the space upon closing. However, the underlying C library keeps these chunks for future use instead of returning them to the system. Attackers send nonstop waves of these tiny, random requests. Ultimately, the system highly splinters its active memory. The total memory size climbs upward until the server fully crashes.
Affected Versions
The OpenSSL HollowByte vulnerability impacts multiple older builds of the software package. Maintainers have successfully patched releases across several major code branches. Unpatched versions leave networks fully exposed to these memory attacks.
Patch or Mitigation Steps
Coders silently fixed the root problem by adding slow buffer growth. The software now only claims memory as real data arrives over the network. The newly secured versions include the 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21 releases. Server admins should update their OS tools right now to prevent downtime. Security groups must check their tool versions by hand since no CVE number exists for auto scanners.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
