USN-8625-1
openssl vulnerability
It was discovered that OpenSSL incorrectly allocated memory buffers in the SSL/TLS state machine when receiving handshake data. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. This issue is known as the "HollowByte" denial of service.
What each source reports
OSV No score
openssl vulnerability
It was discovered that OpenSSL incorrectly allocated memory buffers in the SSL/TLS state machine when receiving handshake data. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. This issue is known as the "HollowByte" denial of service.
- Record
USN-8625-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensslUbuntu:22.04:LTS |
before 3.0.2-0ubuntu1.26, plus listed versions 1.1.1l-1ubuntu13.0.0-1ubuntu13.0.1-0ubuntu13.0.2-0ubuntu13.0.2-0ubuntu1.1 Show 20 moreShow less3.0.2-0ubuntu1.23.0.2-0ubuntu1.43.0.2-0ubuntu1.53.0.2-0ubuntu1.63.0.2-0ubuntu1.73.0.2-0ubuntu1.83.0.2-0ubuntu1.93.0.2-0ubuntu1.103.0.2-0ubuntu1.123.0.2-0ubuntu1.133.0.2-0ubuntu1.143.0.2-0ubuntu1.153.0.2-0ubuntu1.163.0.2-0ubuntu1.173.0.2-0ubuntu1.183.0.2-0ubuntu1.193.0.2-0ubuntu1.203.0.2-0ubuntu1.213.0.2-0ubuntu1.233.0.2-0ubuntu1.25 |
3.0.2-0ubuntu1.26 |
opensslUbuntu:24.04:LTS |
before 3.0.13-0ubuntu3.12, plus listed versions 3.0.10-1ubuntu23.0.10-1ubuntu2.13.0.10-1ubuntu33.0.10-1ubuntu43.0.13-0ubuntu2 Show 10 moreShow less3.0.13-0ubuntu33.0.13-0ubuntu3.13.0.13-0ubuntu3.23.0.13-0ubuntu3.33.0.13-0ubuntu3.43.0.13-0ubuntu3.53.0.13-0ubuntu3.63.0.13-0ubuntu3.73.0.13-0ubuntu3.93.0.13-0ubuntu3.11 |
3.0.13-0ubuntu3.12 |
opensslUbuntu:26.04:LTS |
before 3.5.5-1ubuntu3.3, plus listed versions 3.5.3-1ubuntu23.5.5-1ubuntu13.5.5-1ubuntu33.5.5-1ubuntu3.2 |
3.5.5-1ubuntu3.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-8625-1 is a vulnerability with no CVSS score yet in openssl, published July 30, 2026. No source lists public exploit code. Fixed in openssl 3.0.2-0ubuntu1.26.