OpenSSL HollowByte Flaw Can Exhaust Server Memory With Minimal TLS Request
A newly disclosed vulnerability in OpenSSL, named HollowByte, can cause unpatched servers to allocate up to 131 KB of memory in response to only 11 bytes of malicious TLS request data. This memory remains tied up until the server process restarts, potentially leading to denial-of-service conditions. The flaw was fixed quietly in June without a CVE or official advisory, after being reported by Okta's Red Team.
What happened
Okta’s Red Team discovered a flaw in OpenSSL that allows a tiny 11-byte TLS request to trigger the server into allocating a large chunk of memory—up to 131 KB—that is never released until the affected process restarts. This behavior effectively freezes the allocated memory, contributing to denial-of-service (DoS) scenarios on systems using the GNU C Library (glibc). The vulnerability was named HollowByte by Okta and reported to OpenSSL.
OpenSSL addressed the issue with a fix released in June 2026 but did so without issuing a CVE identifier, publishing an advisory, or including a changelog entry relating to the vulnerability. The limited public information on the fix means many operators may be unaware of the need to update.
Why it matters
This vulnerability is notable for the disproportionate impact of a very small TLS request, allowing an attacker to exhaust server memory with minimal effort. Since the allocated memory stays reserved until the OpenSSL process is restarted, repeated exploitation could degrade server performance or cause outages, affecting service availability.
The absence of a CVE or clear advisory poses challenges for security teams in identifying and prioritizing this risk. Without prominent notification, deployment of the patch may be delayed, increasing exposure to potential exploitation.
What security teams should do
Security teams should verify if their infrastructure is running OpenSSL versions released prior to the June 2026 fix and plan to update to the latest OpenSSL release that addresses the HollowByte issue. Since the vulnerability affects memory allocation on glibc-based systems, teams should also monitor server resource usage for abnormal memory consumption linked to TLS traffic.
Additionally, organizations should ensure that incident response processes include awareness of this issue, specifically regarding the need to restart affected processes to free allocated memory until patched versions are deployed.
Key technical details
The HollowByte vulnerability is triggered by sending an 11-byte TLS request to an unpatched OpenSSL server, causing it to allocate up to 131 KB of memory for a message that never arrives. The memory remains allocated and unavailable for reuse until the OpenSSL process is restarted. This behavior was confirmed on systems using the glibc (GNU C Library) implementation, as tested by Okta.
OpenSSL’s fix rolled out in June 2026 without a formal CVE number, advisory, or detailed changelog entry, making detection through normal vulnerability tracking systems more difficult. The underlying issue is a denial-of-service condition stemming from resource exhaustion caused by minimal crafted input.
Affected organizations/products
The vulnerability affects OpenSSL servers running on glibc-based systems that have not applied the June 2026 fix. Specific OpenSSL versions impacted were not detailed. No other organizations beyond Okta’s research input are specifically named in relation to exploitation or impact.
Source attribution
https://thehackernews.com/2026/07/openssl-hollowbyte-flaw-could-freeze.html
