OpenSSL closed this DoS as an undocumented bug, so the usual patch and scanner workflow can miss it even after the fix exists. HollowByte lets an unauthenticated attacker send an 11-byte TLS request that makes the server reserve memory for a much larger message, then leaves that memory tied up; on glibc systems the freed chunks can stay fragmented and keep RSS elevated long after the connection drops.
The fixed releases are OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21, all dated June 9. Okta Red Team said standard connection limits do not stop the failure mode, because the damage comes from allocator churn and memory growth, not just too many open sessions. This matters most for teams that rely on changelog-driven checks or automated vulnerability tooling to tell them what needs attention.