WS-2026-0012

OpenSSL TLS/DTLS handshake memory-bloat DoS "HollowByte": when reading a handshake message, tlsgetmessagebody allocated the initbuf to the full message size declared in the 4-byte handshake header before the payload data arrived. A remote peer can send a tiny 11-byte message header claiming a ver...

OpenSSL tls_get_message_body Function init_msg Structure Use After Free (CVE-2016-6309)

A use-after-free vulnerability has been reported in the tlsgetmessagebody function of OpenSSL. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted message to the vulnerable server. Successful exploitation allows the attacker to execute arbitrary code on the...