Vulnerabilities · 56 days ago
OpenSSL closed this DoS as an undocumented bug, so the usual patch and scanner workflow can miss it even after the fix exists. HollowByte lets an unauthenticated attacker send an 11-byte TLS request that makes the server reserve memory for a much larger message, then leaves that memory tied up; on glibc systems the freed chunks can stay fragmented and keep RSS elevated long after the connection drops.
The fixed releases are OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21, all dated June 9. Okta Red Team said standard connection limits do not stop the failure mode, because the damage comes from allocator churn and memory growth, not just too many open sessions. This matters most for teams that rely on changelog-driven checks or automated vulnerability tooling to tell them what needs attention.
3 sources covering this story
OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability
Attackers could send waves of malicious payloads to trigger buffer pre-allocations that are not freed, exhausting server memory.
OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests
OpenSSL fixed HollowByte after 11-byte TLS requests could strand memory on glibc systems, but shipped no CVE, advisory, or changelog note.
HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload
A vulnerability dubbed HollowByte allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on OpenSSL servers with a malicious payload of just 11 bytes.
Part of the PlainSec briefing for 2026-07-20