Vulnerability Management HollowByte vulnerability allows denial-of-service attacks on OpenSSL July 20, 2026 Share By SC Staff (Adobe Stock) A denial-of-service (DoS) vulnerability, dubbed HollowByte, has been discovered in OpenSSL that allows unauthenticated attackers to crash servers with a minimal malicious payload. The OpenSSL team has addressed the issue by silently patching it and backporting the fix to older versions, as reported by Bleeping Computer. The HollowByte vulnerability, detailed by Okta's Red Team, exploits a flaw in how OpenSSL handles TLS handshake messages. Attackers can send an 11-byte payload with a header falsely claiming a much larger message size. Vulnerable OpenSSL versions allocate memory based on this false claim before validating the actual data, causing the server's worker threads to block indefinitely. This can lead to significant memory fragmentation and a continuous increase in the server's Resident Set Size, requiring a process restart to reclaim memory. OpenSSL is a foundational library for secure internet communication, embedded in popular software like NGINX, Apache, Node.js, Python, and various databases. While DoS attacks are typically less severe than data breaches, HollowByte can cause operational disruptions and reputational damage, even on high-spec servers where memory loss can reach 25% without triggering alerts. The fix, backported to multiple OpenSSL versions, ensures memory is allocated only after data arrival, ignoring header claims. Source: Bleeping Computer SC Staff Related Patch/Configuration Management Windows 10 devices carry 3 times the risk of Windows 11, data shows SC Staff July 17, 2026 New data from Lansweeper indicates that approximately 16.9% of Windows client devices, or one in six, continue to operate on Windows 10. Patch/Configuration Management Microsoft pauses Windows 11 update for Dell PCs due to compatibility issues SC Staff July 17, 2026 The update, released on July 14, was halted after reports indicated that a number of Dell devices displayed a yellow exclamation point next to the Intel Innovation Platform Framework Processor Participant driver in Device Manager. Exposure management Cut to the chase: How to save time and effort through validation in exposure management Paul Wagenseil July 17, 2026 As AI pumps up the volume of newly discovered vulnerabilities, continuous control validation lets security teams cut through the noise. Related Events Cybercast Why Mythos is the cybersecurity crisis we need Wed Jul 22 Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Bug Buffer Overflow Disassembly You can skip this ad in 5 seconds