Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: Medium
Victim: Organizations using unpatched OpenSSL on glibc-based systems
Incident: A resource exhaustion vulnerability in OpenSSL’s TLS handshake process.
Impact: Denial-of-service via memory fragmentation and system OOM kills.
Attacker: Unidentified threat actors
Analysis: The HollowByte flaw exploits how OpenSSL handles TLS handshake headers, forcing memory allocations that glibc fails to return to the kernel. This results in heap fragmentation and eventual Out-of-Memory (OOM) crashes, bypassing standard connection-limiting defenses. The risk is amplified by the lack of a formal CVE or advisory, leaving administrators unaware of the need to patch.
Recommendations: Update OpenSSL to versions 4.0.1, 3.6.3, 3.5.7, 3.4.6, or 3.0.21 immediately.; Monitor server memory for unexplained increases in resident set size (RSS) during TLS handshakes.; Implement aggressive timeouts for incomplete handshakes at the network edge or load balancer.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source