OpenSSL Vulnerability Allows DDoS with 11-Byte Payload
A minimal attack surface can cause outsized infrastructure disruption.
The HollowByte flaw
Security researchers have identified a denial-of-service vulnerability in OpenSSL servers that can be triggered by unauthenticated attackers using a malicious payload of just 11 bytes. The flaw, dubbed HollowByte, causes server memory to bloat until the service becomes unavailable.
OpenSSL is widely used encryption software that underpins secure communications across much of the internet. The vulnerability's small footprint makes it easy to weaponize in distributed attacks.
What server operators should know
Organizations running OpenSSL-based servers should monitor for patches and review their denial-of-service mitigation strategies. The low complexity of the attack makes it accessible to a wide range of threat actors.
DDoS protection mechanisms that rely solely on payload size filtering may not catch this variant. Rate limiting and memory monitoring become critical controls.